Recent high-profile data breaches have brought the issue of protecting confidential information to the forefront of the security industry and the public mind.
In October of this year, reports were issued revealing that the magnitude of the TJX data breach was far greater than previously indicated - with fraud-related losses on Visa accounts alone ranging from $68 million to $83 million, spread across 13 countries.
With the Privacy Rights Clearinghouse reporting that over the last two years data leaks have comprised more than 150 million personal data records in the U.S. alone, it is clear that the problem of data breaches won't be going away any time soon. As such, it is no surprise that governments in many countries, including Canada, are considering laws that will mandate how sensitive data is handled by large enterprises and small and medium-sized businesses (SMBs).
Now a litigious discussion across the country, the question has been raised as to whether it is the government's responsibility to implement standardized data breach laws - particularly in the U.S., United Kingdom and in Canada.
Critics of Canada's privacy legislation, specifically PIPEDA, are calling for stricter rules and harsher penalties that would be similar to legislation being introduced in the U.S. However, in the US, recent attempts to introduce farther-reaching data breach laws (like the California Assembly Bill 779) have been vetoed with the reasoning that the private sector is better equipped to manage data security than the government.
Governments, whether in Canada, the U.S. or the UK, will face a monumental challenge if they try to prescribe what exactly constitutes "confidential information" and how that data should be protected. Rather than the government creating standardized measures that would dictate what actions should take place after a data breach, the onus should be on the businesses themselves to protect confidential data proactively.
Across different industries and organizations, the definition of 'sensitive information' varies greatly. It may be patient forms at a hospital, patent applications at a research facility or credit card numbers at a retail store. There are some common threads among all industries, but the nuances from one business to the next will make it nearly impossible for any government to make an overarching definition of sensitive information.
Even within each organization, many different types of sensitive information exist and each must be treated with varying levels of security appropriate to its specific requirements.