by Jaikumar Vijayan
Proposed legislation in Congress could have some important privacy and security implications for companies outsourcing work to offshore destinations.
The bill (S1232), called the Safeguarding Americans From Exporting Identification Data Act (SAFE-ID), was introduced by Sen. Hillary Rodham Clinton (D-N.Y.) last month.
It has been referred to the Senate Committee on Commerce, Science and Transportation.
Calls to Sen. Clinton's office seeking comment weren't returned, so it's unclear whether a hearing on the bill has been scheduled or whether a companion bill has been introduced in the House.
"We don't know if this thing has legs or not yet," said Peter Adler, a partner at Foley & Lardner LLP in Washington. "But I don't think that this will be the last we are hearing of bills such as this." California alone has more than a half-dozen pending bills that seek to impose varied privacy safeguards on outsourced personal information.
Driving interest in such legislation are the growing privacy concerns relating to financial and health care information being sent offshore as part of outsourcing initiatives, including medical transcription work, he said.
SAFE-ID proposes a set of privacy-related conditions that need to be met by U.S. companies transmitting personally identifiable information to a foreign affiliate or subcontractor. Under the proposed act, companies could transmit such information to any country that is deemed by the Federal Trade Commission to have a legal system that provides for "adequate privacy protection."
But the law as proposed doesn't address data that has already been transmitted to and stored in foreign locations, said Stephen Wu, CEO of Infosec Law Group, a law firm in Mountain View, Calif. It's also vague about what would happen in situations when data might be retransmitted by subcontractors, said Wu. "There's going to be a lot of interpretations if this becomes law," he said.
Source: ComputerWorld.com
