You may need to squint to see it, but amid all the legislative fireworks over healthcare and financial regulation, Congress is also finally taking some substantive steps to overhaul the country’s tangled mess of data privacy laws.

As 2009 drew to a close, the House passed a bill that would set a federal standard for when corporations must disclose privacy breaches and require them to adopt measures to secure customers’ personal information. The Senate is also mulling legislation that would impose a federal breach notification standard and require companies to adopt information security measures.

If approved—and to be ...