Congress has latched on to the matter and has been furiously introducing and moving legislation with about 10 bills circulating between the two chambers. "Nobody knows right now what's going on," NAFCU Associate Director of Legislative Affairs Debbie Kwon-Moore explained. On May 11, a House Judiciary subcommittee held a hearing on its own bill, Cyber-Security Enhancement and Consumer Data Protection Act of 2006 (H.R. 5318), and a markup was slated for May 18. This bill focused mainly on the investigation, prosecution and penalties for cyber-crimes and stealing personal information.

However, NAFCU favors the legislation that came out of the House Financial Services Committee, the Financial Data Protection Act of 2005 (H.R. 3997), which gives consumer reporters-those handling personal information to assemble or evaluate for consumer reports, payments or employment purposes, and facilitates interstate commerce-"an affirmative obligation" to protect the information against unauthorized use "reasonably likely" to bring "harm or inconvenience" to the consumer, according to a bill summary. It also prescribes guidelines on investigations, third party duties, consumer notice, fraud mitigation, and free file monitoring.

"It's those entities that aren't regulated that should be focused on," Kwon-Moore said, such as the retailers. The legislative frenzy was born out of a few highly publicized data security breaches, like at BJ's Wholesale Club, where retailers held on to consumer information that they should not have.