Gov. Schwarzenegger Vetoes CU-Backed Data Security Bill

SACRAMENTO, Calif. – Citing costs to small businesses, Gov. Arnold Schwarzenegger last week vetoed the data security bill that was passed by the state legislature with heavy support from the credit union lobby. The governor, citing the Payment Card Industry’s Data Security Standard, said the credit union-backed bill "attempts to legislate in an area where the marketplace has already assigned responsibilities and liabilities that provide for the protection of consumers." The bill would have prohibited merchants from storing payment related data without a data retention and disposal policy, even if the data was encrypted. It would have prohibited sending unencrypted credit card data over public networks. And it would have made businesses financially liable for losing customer credit card data, entitling customers a reasonable reimbursement for the costs associated with a breach. In his veto message, Schwarzenegger suggested he was open to a different version of the bill. "I encourage the author and the industry to work together on a more balanced legislative approach," he said. The bill was similar to one passed earlier this year in Minnesota, which was based on a draft provided by CUNA Mutual Group, the credit union insurer that has seen rising losses due to credit card and identity fraud.