WASHINGTON–A top Justice Department official called for a stronguniform federal standard requiring certain types of businesses toreport data breaches in a Judiciary Committee hearing on Tuesday.

“Businesses should be required to provide prompt notice toconsumers in the wake of a breach and to notify the federalgovernment of breaches so that law enforcement can pursue and catchthe perpetrators,” said Mythili Raman, acting assistant attorneygeneral in the criminal division of the Justice Department, duringthe hearing titled, “Privacy in the Digital Age: Preventing DataBreaches and Combating Cybercrime.”

Read more from this hearing: Target Exec Says EMV Carries $100M Price Tag

Raman referenced a 2011 proposal from the Obama administrationon cybersecurity as a model for the path Congress should pursue on the issue.

“Business entities must notify any individual whose sensitive,personally identifiable information has been, or is reasonablybelieved to have been, accessed or acquired, unless there is noreasonable risk of harm,” she said.

“Business entities covered under this requirement are those thatuse, access, transmit, store, dispose of, or collect sensitive,personally identifiable information about more than 10,000 peopleduring any 12-month period,” she added.

Raman, who oversees almost 600 attorneys in her department, saidthe Obama Administration believes businesses that have demonstratedeffective data breach prevention programs should be exempt from having tonotify individual customers about a security breach.

This exemption would be contingent upon the conclusion of a“risk assessment” showing there is no reasonable risk that asecurity breach will harm the individuals whose information wascomprised.