Edited expert comments are provided on the law that should be passed by Congress to require federal consumer notification in case of a data security breach. Commenting are Gail Hillebrand, senior attorney in the San Francisco office of Consumer Union, and Oliver Ireland, a partner with law firm Morrison & Foerster. Mr. Ireland has represented the financial-services industry in front of Congress on this issue. Ms. Hillebrand says consumers need a strong law with no loopholes that should also make sure that there are restrictions on Social Security number use and sale, as well as a consumer-friendly security freeze. Further state protections should also remain available. Mr. Ireland agrees on the protection of SSNs, and both agree that each individual's data is valuable and should be protected and that a federal bill would be the optimal solution. However, as to the federal security freeze law (which permits people to block companies from seeing their credit report or score so that identity are blocked from opening new accounts with stolen data), Mr. Ireland says Our goal should be to protect consumers from identity theft while not interfering with their ability to get credit, insurance, or employment or to engage in other transactions. At issue is whether people would have to lift a freeze to allow a lender access to credit information again. Among other issues argued by Hillebrand and Ireland are suggestions for protection of SSNs, whether or not the primary purpose of notice is to provide an incentive for tighter security, the need for better security, how consumers will be enabled to make informed choices on proceeding, and the importance of maintaining states rights in development of new and improved ways to provide financial privacy and to fight the always-changing identity theft problem set.