Monday, Sep. 29, 2008

Our View: Governor should sign ID theft bill

When you use your credit or debit card in a store, merchants have the opportunity to collect personal data from it -- data such as your password, PIN, address and other information.

If that merchant acts responsibly, such personal information is quickly eliminated from the store's system.

But if that merchant fails to follow standards developed by the retail industry, that personal data can be held in a computer or passed among public data networks, where it can become vulnerable to hackers.

Such lax practices led to a 2005 hacking incident at TJ Maxx/Marshalls that compromised the data of 45 million customers.

Since then, hackers have continued to grab personal data from stores that fail to safeguard customer's private information.

More than 449 such breaches have already occurred this year, according to the Identity Theft Resource Center, a nonprofit group based in San Diego. That's a spike from 2007.

This year, California lawmakers passed Assembly Bill 1656, a bill that could go a long way toward preventing breaches and reducing credit card fraud and ID thefts.

This bill, by Assemblyman Dave Jones of Sacramento, would prevent merchants from storing sensitive card data. It also would block them from transmitting it over public networks, without encryption.

Gov. Arnold Schwarzenegger vetoed a version last year because of provisions that, he said, might hurt small businesses.

Jones worked with his office to address those concerns, dropping a provision that would have required retailers to reimburse financial institutions for costs incurred for replacing cards caught up in security breaches.

His bill passed the Assembly 74-1 and the Senate 34-3.

While retail industry lobbyists continue to oppose AB 1656, it's hard for them to claim their voluntary standards are protecting consumers.

Too many retailers continue to recklessly store personal information.

That needs to stop. AB 1656 would help. The governor should sign it.