The revelation last week that data collector ChoicePoint has mistakenly given private information on up to 145,000 U.S. residents to identity thieves has led to renewed calls in Washington, D.C., for a national data privacy law.

ChoicePoint, based in Alpharetta, Ga., reached agreement Feb. 16 with 19 state attorneys general to tell the 145,000 potential victims that ID thieves may have gained access to personal information such as Social Security numbers and credit reports. Potential victims live in all 50 U.S. states, the District of Columbia, Puerto Rico, Guam and the U.S. Virgin Islands.

The ChoicePoint problem points to the need for a national privacy law, said representatives of the Electronic Privacy Information Center (EPIC) and the Center for Democracy and Technology (CDT), both privacy advocacy groups. For most U.S. companies, the only ID theft notification that's required is a California ID theft law, which requires companies doing business in the state to notify customers if their personal information has been accessed by an unauthorized person. The California law went into effect in July 2003.

"There certainly is agreement that we need better notification, exactly because of cases like this," said Ari Schwartz, associate director at CDT. "We're seeing (data companies) selling it to a lot of different people."

ChoicePoint has access to about 19 billion public records, and the company reportedly has information on virtually every adult living in the U.S.

In addition to calls for legislation from privacy advocates, Sen. Dianne Feinstein (D-Calif.) has called for congressional hearings on a piece of privacy legislation she introduced this year. Feinstein's Notification of Risk to Personal Data Act, introduced Jan. 24, would require businesses and government agencies to notify the likely victim when there is a "reasonable basis to conclude" that a criminal has obtained unencrypted personal data.

Feinstein's bill lacks co-sponsors, and a similar bill of hers went nowhere in Congress in 2004. Asked of the bill's chances in 2005, a Feinstein spokesman said the ChoicePoint problems have shown the need for legislation.

"Moving any bill is always a difficult prospect, but now more people are coming to an understanding of the issue of identity theft," the spokesman said.

The IDG News Service is a Network World affiliate.