|
The stories are increasingly frequent in the news. Consumers are being told to protect their confidential information against a new breed of criminal – identity thieves. Armed with little more than a name and a date of birth, these new-age robbers can steal money and damage credit ratings with lightning speed – sometimes with just a click of a mouse. Every consumer has heard the warnings – don’t put your social security number on checks; shred sensitive financial documents before putting them in the trash; never disclose sensitive financial information via email. But what about the personal information people voluntarily disclose to businesses in the course of authorized transactions? Is that information safe? It appears the answer is no.
In 2007, the Identity Theft Resource Center, a non-profit organization headed by former victims of identity theft, documented 446 paper and electronic security breaches which compromised more than 127 million records, up from 315 breaches affecting 20 million people in 2006. The ITRC has confirmed 167 reported breaches during the first quarter of 2008. Nearly thirty-six percent (36%) of the breaches have involved businesses. In a recent case from March of 2008, a computer server at the Central Collection Bureau in Indiana was stolen. The server contained the personal information of over 700,000 people including Social Security numbers.
How can you help protect your customers from identity theft? Here are some tips from the Federal Trade Commission.
First you are required by Law to protect and keep confidential all personal information received from a consumer. The information must be in a secure area with only very limited access by specific dealership personnel (See Gramm v. Leach Bliley Act generally)
To protect customers’ information, you’ll need a five-pronged attack. First, be aware to what information you have. Take stock of your paper files as well as electronic files to find out what information you have, who has access to it, and how it is stored. Second, develop a document retention policy and stick to it by destroying personal information once you no longer have a business reason to keep it. Paper files should be shredded and computer files should be securely erased with a “wipe utility” program. Simply deleting files from your server or hard drives is not enough. Third, make sure you have the proper security in place to safeguard the information in your possession. Paper files should be kept locked and computers containing personal customer information should be protected with firewalls, up to date antivirus and anti-spyware software. Also, make sure any sensitive information that is sent or received over the internet is properly encrypted. Fourth, do a security check of your computer system. Make sure to use strong passwords such as those containing a mixture of upper and lower case letters, numbers and symbols. Avoid obvious choices such as your company name or “password” and change passwords often. Limit employee access to personal customer information as much as possible and have a plan to prevent employees from accessing company files once their employment has ended. Finally, make sure you have a plan in case of a security breach. Know who you must notify if a breach occurs. The list includes consumers, law enforcement, credit bureaus, and other affected businesses.
Failure to safeguard your customers’ personal information can be costly. When a customer’s personal information is stolen due to a business’ failure to properly destroy the information, the Fair and Accurate Credit Transactions Act of 2003 provides for federal fines of up to $2,500.00, and state fines up to $1,000, per incident. In addition, the business is liable for any damages the individual suffers as the result of the breach.
It is important to note that businesses can also become victims of identity theft. A thief who obtains a business’ taxpayer identification number can apply for corporate credit cards and have them delivered to his mailbox. According to BusinessWeek.com: “[T]he most sophisticated identity thieves increasingly are targeting businesses because the payoffs are bigger [.] *** Business accounts generally have higher credit limits and make larger purchases than consumers, so hefty charges by scammers are less likely to raise red flags. While most consumer frauds won't net a criminal more than $5,000, targeting a business can bring in 10 times that or more, *** so [f]rom a criminal's viewpoint, it's far more cost-effective to target a business rather than a consumer."
Many of the same safeguards advised for consumers also apply to businesses – keep sensitive files locked up, restrict sensitive business information to only those who need to know and keep a close eye on the business’ financial records to watch for unauthorized transactions.
Identity theft is a growing problem but a vigilant plan can greatly reduce your business’ chances of being victimized.
---------
As always, these are highlights of the law and are not to be construed as containing the entire law. This is not to be construed or relied upon as a legal opinion. If you are presented with this problem, contact your legal counsel for advice.
®Robert A. Poklar, 2008
___________________________________
VISIT OUR WEBSITE: WWW.POKLARLAW.COM
ROBERT A. POKLAR & ASSOCIATES
A Limited Liability Partnership
10100 Brecksville Road
Brecksville, Ohio 44141
Telephone: 440-746-1600
Fax: 440-746-1604
Website: www.poklarlaw.com
e-mail: rap@poklarlaw.com
You Auto Know® - May 2008 - Identity Theft
|
