As Congress holds hearings, press conferences and otherwise wrings its hands over the onslaught of data breaches and resulting identity theft, states are taking action. And California is leading the pack.

Earlier this year, Congress decided California might be onto something. But now Congress is still dithering while states continue to pass laws.

California, for instance, didn't stop at a breach disclosure law. It also passed the nation's first credit file freeze law. Since then, nine other states -- Texas, Louisiana, Vermont, Colorado, Connecticut, Illinois, Maine, Nevada and Washington -- enacted credit file freeze laws.

That's the sort of momentum that catches Congress' attention, as well as that of credit bureaus, banks and think tanks that dread the prospect of myriad regulations that vary from state to state.

In other words, Turner wants a national law pre-empting any state laws. The Identity Theft Protection Act passed by the Senate Commerce Committee in July may be that ticket.

The proposed law requires data brokers, government agencies and educational institutions to disclose breaches to consumers if there is a "reasonable" risk of identity theft.

Once informed of a breach, some in Congress want to follow the states and give consumers rights to freeze their credit files.

"Ideally, an efficient credit freeze law benefits individuals, credit bureaus and lenders," Turner writes. "Individuals would benefit from additional protection against identity fraud. Bureaus would benefit from reduced inaccuracies in credit files … and lenders would benefit from diminished fraud costs."

Opponents of credit file freezing, primarily the entire business community, argue that consumers will lose out on discounts by not being able to apply for store credit cards or will miss the opportunity to purchase a house or a car when they cannot immediately access their credit.

Security experts worry credit file freeze legislation will simply give identity thieves another data platform to crack, freezing and unfreezing the files of identities they've swiped. Ironically, it appears, identity thieves could use a consumer protection tool to elude detection.

"The alarmist scenario of an identity thief taking over someone's identity so thoroughly as to control their entire account line and credit history is unlikely," Turner claims, pointing out that individuals with frozen files will still be able to access their credit reports with a PIN or some other access and verification system.

According to Turner, predictions of a consumer wholesale rush to freeze files will not result in businesses losing sales. Fewer than 2,000 Californians, he notes, have asked to have their files frozen. California, though, requires a mailed request to freeze files.

"Should individuals be able to freeze their credit files through the Internet or the telephone, the percentage of ID fraud victims who elect to freeze their files could increase significantly," he wrote.

Congress will have to sort out all of this when it returns to work after the Labor Day holiday. And while Congress spends time debating, as many as 12 more states are expected to move forward with freeze laws in the near future.

Roberts Vote Could Stall Data Privacy Law
Bill Targets Trafficking in Social Security Numbers