Slashdot Log In
Data Theft and Corporate Irresponsibility?
Posted by
Cliff
on Mon Jun 19, 2006 10:24 PM
from the they-lose-we-pay dept.
from the they-lose-we-pay dept.
cjsnell asks: "Today, I received a letter from a student loan provider notifying me that my name and social security number had been stolen along with a contractor's computer. This makes -four- agencies that have lost my personal information, in the last year. Today's letter was the most disappointing yet: the company, Texas Guaranteed, did not offer any credit report monitoring like the previous three had. Their advice? Send a letter to the credit bureaus. Gee, thanks. Clearly, mass identity theft is completely out of hand and there doesn't seem to be any government regulation for handling these situations, nor does there seem to be any punitive action against businesses that lose customers' data. Do we, as consumers, have any recourse against these businesses?"
This discussion has been archived.
No new comments can be posted.
The Fine Print: The following comments are owned by whoever posted them. We are not responsible for them in any way.
Full
Abbreviated
Hidden
Loading... please wait.
Recourse (Score:4, Funny)
Hi, my name is Lizzy Fair (Score:5, Funny)
I'm appalled by all the anticapitalist rhetoric that is being spewed on Slashdot regarding the corporate use of your personal information and the occasional leak of your SSN into the wrong hands.
You people talk like you want absolute ownership over your personal information. Like you want a corporation - an entity that only exists for the purpose of maximizing net profit - to take responsibility for handling your personal information. Then you'll be holding them liable for mishandling your info. Do you realize what damage this will do to corporate profits?
That utterly reeks of communism. What's next? Treating your personal information as your own property to be handled on your terms and not theirs? Heck, if we follow that line of reasoning, the Government will have to intrude even further into our lives and implement a law to treat personal information brokers like Choicepoint and Unicru as potential data pirates. I can see it now: the Digital Millenium Privacy Act.
Corporations made America, and now you pink commies are about to create a kleptocracy in the name of your overzealous attack on public access to personal information. Sheesh.
[...end Right wing parody]
Parent
Re:Recourse (Score:5, Informative)
Senator Specter,
I am writing to voice my concern over the lack of control many corporations have over my personal information - and just as importantly, the lack of recourse I have as a citizen should those corporations abuse my information. Over the course of the past 60 days, I've received 4 notices that a given corporation - two of which I don't even do business with, nor have I ever - have had my personal information compromised. Two of them were kind enough to provide suggestions as to what steps I should take to monitor this, one of them simply stated that they'd allowed my information to be compromised, and the final one actually sent me an empty envelope. I contacted them based on their return address to make an inquiry, and obtained confirmation that that too had compromised my information.
All this within a two-month period. And these are the ones that have voluntarily divulged that my information has been compromised - I'm assuming there have been other incidents that have not been disclosed.
It's absurdly obvious to me that, at minimum, there needs to be minimum standards of data protection, and recourse for the individual in the event that one suffers personal loss as a result of a corporation not adhering to those minimum standards of protection. In the day of high speed data transmission and very powerful encryption techniques, it's ludicrous that they are transporting these types of sensitive information around on unencrypted computers and on non-secured servers or portable drives.
I do not want to wait until something detrimental occurs to me before I take action. Identify theft has become so common place that it's become background noise, and we as a society have accepted it as a part of life in the modern world - this can not be the solution. Until there are ramifications for corporations that mistreat personal data that results in personal harm, there is no incentive for them to alter their behavior.
I certainly do not have the answer, nor would I presume to tell you what should be done to rectify this. I would, however, ask that you expend some resources to find and implement a solution to the issue. I am quite confident that were the tables turned, and I were to disclose damaging information that affected the fiscal health of those companies, that the repercussions I would face as a result from them would be quite serious.
Thank you for your time.
Regards,
Parent
Re:Recourse (Score:5, Insightful)
If the bank stores all their customers' cash in cardboard boxes behind the building, then yes, prosecuting the bank would be in order.
Also, your rhethorical question is wrong. The robber will be prosecuted in any case (for robbery), even if the bank is prosecuted for gross neglegience.
Parent
Re:Recourse (Score:4, Insightful)
This particular case is more like you depositing a copy of your house key with your neighbour (in case you should lose yours), and that KEY gets stolen. Your neighbour might tell you that the key is gone - and worse yet, that the key actually has a tag with your name and address attached to it. So, until you can go and change your locks, your home is basically compromised and it takes a lot of effort keeping it safe, until the locks are replaced.
With the stolen social security numbers, you can't switch your social security number easily, if at all? Is it possible at all to apply for a new social sec no in the US moving your data to the new one, but invalidating the old one?
In the example with your key getting stolen from a neighbour's property; of course, it's not really the neighbour's fault, if someone breaks into his house.
BUT - the neighbour might be liable, if gross negligence aided losing the key in the first place (i.e. putting up a sign with an arrow pointing to the key with all the data as to whose key it is, right outside on the front lawn - without any protective measure).
If an agency hands over your data to an outside contractor - they HAVE to put safeguards in place (check out the contractor's background/reputation, and *his* security measures), because they are handing away data that you *entrusted* to them. Just handing out blanket data, without properly protecting it (really good encryption, at the least, with the key being nowhere near the laptop during transport), is them breaking your trust.
And THAT is something that might make them very well liable for what happens.
(Needless to say - even those that will pay for free credit checks for a year, what's that to say, at all? THEY broke your trust by not safeguarding the data, and while they pay for the checks (for a limited time), they are not paying for your time following up the checks and/or the hassle in case something happens.)
Parent
Re:Recourse (Score:4, Funny)
It must be wonderful to live in a place where you can feel that secure... I remember it wasn't too long ago that in my town, we didn't have to lock our doors, take our keys out of the car. I wanna live where you do.
So, kindly tell me where you live. Please be specific. Google Maps link if possible. What kinda car do you drive?
Parent
Simple... (Score:5, Funny)
Re:Simple... (Score:5, Funny)
Just Email me with your Name, Address, Social Security number, and Credit Card information and I'll take care of it all.
Parent
Re:Simple... (Score:5, Funny)
They stole my identity, not my stapler.
Parent
Re:Simple... (Score:4, Insightful)
Nope.
If you choose to live in a country where the government is pro-corporation instead of pro-people, you've got to accept that you're powerless. If you don't like the heat, get out of the kitchen -- or do something about the chef :-)
Parent
the less information collected the better (Score:5, Interesting)
Yep... (Score:5, Interesting)
You [b]can[/b] do it, but it can also be a hassle, since you have to educate people (especially health care people, who seem to be clueless as a whole).
Parent
Health Care (Score:3, Interesting)
My data has been lost 3 times in as many years...all by the wonderful work of healthcare related companies. Seriously...how hard is it. Just don't lose it. Better yet...don't store it in the first place.
I've had to put watches on 'my accounts' with the credit reporting agencies myself for each one too. You know how irritating it is that I have to take a couple of hours out of my day to fix some other nimrod's stupidity induced problem? Makes me want to
When a hospital asks for your SSN... (Score:4, Interesting)
Parent
Completely out of hand (Score:4, Insightful)
Re:Completely out of hand (Score:5, Insightful)
We've evolved our own Big Brother via capitalism.
Somewhere, Karl Marx and George Orwell are sharing a laugh from beyond the grave.
Parent
Re:Completely out of hand (Score:5, Insightful)
Parent
starting over (Score:5, Insightful)
Liability, liability, liability (Score:5, Interesting)
1) Create and enforce real liability for loss of personal data. After that it may make sense to introduce "safe harbor" general privacy regulation (unlike domain-specific regulation like HIPAA) where if you comply with the regs, you get relief from liability in the event of a genuine mistake or contingency.
2) Create and enforce real responsibility of credit providers and credit bureaus. Allow consumers to immediately suspend any line of credit, and require true checks before issuing credit (no more instant credit). No more endless paper battles to get credit ratings fixed, charges rescinded, etc. [These previous two were cribbed from Kevin Drum at WashingtonMonthly.com. He expouns on this subject quite regularly]. Liability for failing to properly check that credit is properly issued or used, which is supposed to be the reason why vendors and buyers pay exorbitant credit card rates in the first place.
Get the liability in order and regulation will the preferable alternative.
Re:Liability, liability, liability (Score:4, Insightful)
Parent
Re:Liability, liability, liability (Score:4, Interesting)
Easy. Just make libelous statements on a credit report... libel. You lost your earnest money because you couldn't get a home loan because you allegedly signed up for a credit card, maxed it out, and never repaid it? You get passed up for a job because a car purchased in your name got repossessed? You prove it, you sue the credit bureaus, you win treble damages.
Suddenly, credit bureaus would require a lot more proof before dinging your credit score, and they'd promptly correct their mistakes.
Parent
Pass it forward (Score:3, Funny)
I just got "the letter" too (Score:5, Informative)
Re:I just got "the letter" too (Score:5, Insightful)
Someone who never has the data to lose in the first place.
Parent
Re:I just got "the letter" too (Score:5, Interesting)
Then again, hiring agencies like usajobs.gov want you to email your SSN as part of your application materials, and if you complain, they fire back some bullshit from their privacy policy...this is what they told me:
* emphasis mine to illustrate the absurdity
I never once argued about whether they could or should be asking for. I was only asking for alternative methods besides frickin e-mail on how to provide it.
Parent
Re:I just got "the letter" too (Score:5, Insightful)
That would be the most bitchin' thumb drive, wouldn't it? You could show it to all your friends and taunt them. I'd better not lose my keys or you're all screwed!
Parent
Japan has a strong law (Score:3, Informative)
Not the best solution, but... (Score:5, Funny)
There's always the solution from Fight Club. [imdb.com]
Oops. I'm not supposed to talk about that. Forget I said anything, will ya?
Class Action Lawsuit would work. (Score:3, Funny)
Me too (twice even)! (Score:5, Interesting)
Anyway to answer your question: IMO (and IANAL), the court would not force the 3rd party who's information was stolen to compensate your ID theft protection service, should you take it to a small claims court. However, if your credit record was destroyed as a result, I think you would have a better chance at winning some financial compensation for your case. So the best short-term answer I guess would be: put ID fraud alert on ASAP and unless you have spare time and a thirst for absolute justice, don't take it to court (although you could ask them nicely to compensate you, at least partially if not fully).
The long-term solution here people, is to get a god damn law passed. This is absolutely ridiuclous how much this occurs, and its usually because of poor/inadequate/incompetent security on the fault of the 3rd party containing the info. I am actually very interested in proposing such a bill to our legislative branch, but I'm an engineer and a grad student, and I have little time to spare right now. If someone is interested in moving this forward, let me know about it because I would like to do what I can to be involved. I believe such a bill should cover:
1. The circumstances under which a company/school/whatever may contain your personal information
2. The length of time under which they may retain that information (with mandatory and permanent removal after a given period of time)
3. A definition of the minimum necessary security measures a party must take when retaining another's personal information
4. Explicitly stating to the person when they will retain their information, for how long, and what security measures they will take to protect it
5. In the case of theft, if parts 1-4 are not satisfied, the party owes full monetary compensation for providing ID theft protection, and also granting the person the right to choose what ID protection service and what level of protection they want
6. In the case of theft, if parts 1-4 are satisfied, the party owes a minimal monetary compensation for ID theft protection that meets certain stated requirements.
How's that for a start?
Re:Me too (twice even)! (Score:4, Informative)
7. In the case of theft, any and all persons that may have had their information stolen in the theft must be informed within a 48 hour period upon discovery of the theft. No party may with hold or keep secret the theft any longer, or they are subject to further financial obligation to the victims.
Of course "48 hours" is something I pulled out on a whim right now, and "all persons that may be effected" can be intentionally misinterpreted by a party. In reality, if one person's information was stolen, there is a non-zero chance that everyone else had the possibility of having that information stolen.
Parent
Re:Me too (twice even)! (Score:3, Insightful)
It's a great start. All you're missing is about a billion dollars or so in cold, hard cash. That being roughly the amount of money you'd need to toss around Capitol Hill in order to buy enough politicians to ever have a shot at passing something when every financial institution, insurance company, and data-mining outfit in the country would be fighting it tooth-and-nail.
Come to think of it, I doubt a billion bucks would be enough.
I think this is going to be another area where the corp
Re:Me too (twice even)! (Score:4, Interesting)
A while back when it first came out that you could call up certain companies and for less than $100 get basically anyone's cell phone records, I remember that somebody did it to the Canadian Privacy Minister (or someone to that effect, I forget their actual title) and mailed the results to them.
Short of actually tossing tons of money at them, that's probably one of the more effective means of influencing politicians on privacy issues: make them care by putting their privacy into question along with everyone else's.
I wouldn't ever advocate anything illegal per se, but a lot of good could potentially come from a massive data theft of every member of Congress' credit histories and banking records (besides just finding out who's really on the take).
Parent
Don't be so quick to give it up (Score:3, Insightful)
--
http://wi-fizzle.com [wi-fizzle.com]
Sue them (Score:3, Informative)
You can place a fraud alert on your credit report (Score:5, Informative)
The easiest way to put an alert is to use the online form at Experian; alternately, you can call any of the credit reporting agencies to also set up an alert, if you want to do it by phone, instead.
The direct link for the Experian site to do this is:
https://www.experian.com/consumer/cac/InvalidateS
More advice available here for identity theft victims:
http://www.consumer.gov/idtheft/con_steps.htm [consumer.gov]
Hopefully, you will not need it.
-- Terry
Re:You can place a fraud alert on your credit repo (Score:3, Insightful)
Cheers,
-b
What I've done (Score:5, Insightful)
Instead I've gone on the defensive and assumed that my identity is already compromised. I coughed up $130 for 3 in 1 credit monitoring services (one of the big three credit bureaus has a two for one going if you call them. got a spouse?). I also keep close tabs on my credit and debit card activities, which doesn't require all that much effort since I cancelled all but 2 credit cards and my debit card. It means some money and time spent up front, but it's not too intrusive and it gives me a reasonable degree of confidence.
As long was we maintain some degree of privacy, identity theft is here for the forseeable future. I'm not saying don't hold companies responsible. I am saying realize that many companies in control of your information will be irresponsible regardless of what they can be held accountable for and that it's a good idea to take some personal responsibility for protecting yourself.
class action lawsuit (Score:4, Insightful)
Recourse? (Score:3, Insightful)
I've been hit three times myself in the last 4 months. What am I supposed to do, sue three $50B corporations?
Oh, and don't believe the neanderthals that tell you the free market lets you "vote with your business" -- not when everyone seems to be involved.
Identity Theft Protection Act bill in the Senate (Score:3, Interesting)
One is dated July 14th 2005, while the second version is dated December 8th 2005. Get off your ass and call up your senator and tell them that you feel this bill should be passed into law to protect you as either a former victim, or possible future victim. Cite some recent examples of identity theft from the news. Tell them that this is more important to you as a citizen that they are supposed to represent, compared to whatever other "important agenda" they are talking about right now in the Senate (gay marriage, starting MORE wars with countries in the name of "freedom", etc). Don't just whine and complain because no one is going to want to listen to you. Instead, push and shove so that they will be forced to do something about it!
(Cue Braveheart moment) - FFFFFRRRRREEEEEEEDDDDDDOOOOOOMMMMMM!!!!!
Oh yeah, and don't forget to buy LOTS of stock in identity theft protect companies! Citizens will win, and irresponsible parties will lose!
Credit freeze under fire (Score:5, Informative)
Credit Freeze Under Fire [sfgate.com]
'The so-called Financial Data Protection Act of 2006 (HR3997) would also weaken state laws requiring disclosure of security breaches. In California, businesses must notify people if their personal info "was, or is reasonably believed to have been, acquired by an unauthorized person."
'Under the proposed federal legislation, such disclosure would have to be made only if a company determines that a security breach "is reasonably likely to result in harm or inconvenience" to individual consumers.
'"Basically, the company would have to know that you're a victim of identity theft before it needs to tell you that you could be a victim of identity theft," said Ed Mierzwinski, director of the U.S. Public Interest Group's consumer program in Washington.'
Best solution is... (Score:5, Insightful)
That's right, cat's out of the bag. Can of worm has been opened. Too late.
Ban use of Social Security Number as an identifier, except for Social Security, like it was supposed to be in the first place.
Each business entities must use their OWN issued numbers.
Wide-reaching Identity Theft Containment problem limited to just the affected business.
Now, it is time to look into three-way public keys to ensure that consumer data is not misused:
1. Merchant/Business/Corporation
2. End-user/User/
3. Arbitrator/Government
With keys signed by each other in 3-ways, secured identification and security of data compartmentilization has been greatly enhanced.
Each and every transaction is signed, sealed and delivered by all 3 parties.
Now, let's get an infrastructure going on this...
Even Bruce Schneier [schneier.com] agrees to this.
Credit Card companies make money on fraud! (Score:4, Insightful)
http://www.smithfam.com/news2/july02a.html [smithfam.com] ;-)
http://www.answers.com/topic/credit-card-fraud [answers.com]
One of the two (answers/wikipedia) plagerized the other.
http://en.wikipedia.org/wiki/Credit_card_fraud [wikipedia.org]
Make the credit card companies take responsibility. Make it them that has to pay for fraud and the situation will rememdy itself overnight!
How did we get here? SSN as private information? (Score:4, Interesting)
I don't hate the stupid companies who loose SSN numbers, instead, I'm bothered on how we as a country got into this mess into the first place.
I helped my parents this last week with a garage sale. During the sale, my mom noticed that an old table for sale had her SSN engraved in the wood! Why? Because back in the late '70s early '80s, the local police department told citizens to put a SSN on your assets in case they were stolen (Ironic, Eh?). She spent 20 minutes frantically trying to rub out her ID, she was visibly shaken.
OK, I understand the need to pass SSN/Taxpayer ID information between the Social Security Administration, IRS, Banks/Credit Unions, and your Employers.
The real problem is that there are so many other business segments who need to validate your identity, that they have piggy backed usage of the SSN as the de facto form or Identity verification. This is the real segment that needs to change their behavior!
I mean, how hard is it to go into the local Car-Toys, order a bitchin' stereo on zero money down, and forge the credit application with a stolen SSN and other personal info? And the problem is not just limited to your SSN! Your credit card number(s) have the same problem. If you know the number, expiration date, and Security code on the card, that's all it takes for many purchases over the phone or internet.
The real problem in our modern society is identity verification. Anyone who has ever forgotten a password to a website (what is up with all the different password complexity rules?), everyone who has ever wondered if that waitress is taking so long is because she is ordering a new dress from Victoria's Secret on your card, and everyone who wondered why their bank insists on a utility bill to verify your place of residence due to a clause in the "Patriot Act". You know what I'm talking about.
IMHO, what we really need in this country is not a credit score, but an identity score for identity(ies) that are independent from our SSN/Taxpayer ID (not government controlled, sorry). If I purchase a candy bar with a credit card, the level of identity verification required is low, if I purchase a new car with a loan, then I suspect the level of identity verification would be much higher! The credit score should be weighted against the integrity of the identity given too. If someone fills out a credit application with just a name, address, and SSN, then the chance for fraud is high, and the integrity of the information is low. If the person supplies a trusted smart card certificate, with a complex PIN, along with some other kind of biometric data, then the integrity is much higher.
<Sigh...>
DO something when this happens to you. (Score:4, Interesting)
Re:Prepaid legal (Score:4, Insightful)
An MLM scheme will help me with my fears? Do they offer counseling to overcome these fears?
I got modded down last time...
No kidding. It's like all these free iPod sites -- you get modded down because you're just hoping people will join your MLM so that you can personally profit from their fears.
Parent
Re:I think Ice Cube said it best (Score:5, Insightful)
Just like the Jefferson fiasco - FBI busts down a citizen's door, it's strong justice; bust down a Congresscritter's door and it's a CONSTITUTIONAL CRISIS!!!!omgwtfbbq
Parent
Re:Maybe... (Score:5, Informative)
Ernst & Young
Humana
AIG
Union Pacific Railroad
The State of Colorado
The State of Oregon
The State of Minnesota
Hotels.com
University of Miami
University of Kentucky
Miami University of Ohio
The YMCA
The Red Cross
The Department of Energy
The IRS
The Veterans Administration
The IRS
Parent
"Get over it" and serve your masters (Score:4, Insightful)
Having no privacy isn't the problem in itself; the problem is other people exercising control over you with that information. Don't "get over it." Stand up to it.
Parent