U.S. Businesses Under Regulatory Scrutiny for Data Privacy Standards

U.S. businesses for years have urged the government to let them set computer-security standards of their own, but their inability to do so could now prompt Congress to step in, experts say.

Those who worry that regulation may stifle innovation say the business community may have already missed an opportunity to prove the government's help is not needed.

"The market is in a much better position to respond to this challenge...but corporate America has not provided evidence across the board that they've taken this issue seriously enough to protect consumers," said Bob Dix, a lobbyist for Citadel Security Software, who until last year handled cybersecurity for a congressional subcommittee.

The private sector is under scrutiny after a string of incidents at data brokers, retailers and other businesses exposed at least half a million U.S. citizens to identity theft.

The business community for years has argued that any government regulations would quickly become outdated in a rapidly changing field, and a 2003 Bush administration plan called on the private sector to set its own standards.

Working with the the Homeland Security Department, an industry-led task force issued a set of guidelines in April 2004 that called for company chief executives to take direct responsibility for their computer systems.

One year later, only two companies have adopted the guidelines: Entrust and RSA Security, whose chief executives co-chaired the task force.

The link for this article located at ZDNet News is no longer available.