Wednesday, February 23, 2005

A two tiered response to privacy violations?

Does anyone else see not just a slight, but a massive inequity between what happened when Paris Hilton's personal phone information got stolen, and what happened when ChoicePoint managed to give away personal details of not just one, but potentially hundreds of thousands of people?

In one situation we have a bunch of celebrity phone numbers and some happy photo snaps posted on the web. A few celebs get their phones jammed with crank calls and no doubt quickly got a new phone number, big deal. I'm sure that T-Mobile has probably dished out new phones and free T-Mobile service credits to everyone concerned even if, as it is likely to be the case, they weren't to blame for the "hack". So, one emabarassed celebrity who probably wont get anyones phone number given to her again, and a huge amount of press, and bad PR for T-Mobile even though its quite possible she just had a dumb password that someone guessed.

In the other case we have a bogus application to ChoicePoint resulting in the release of names, addresses, phone numbers, social security numbers and every else the budding identity fraudster needs to steal the identity of thousands of people. And even after the fact, even those who didn't yet get their identity stolen (several hundred already did), the rest and sit back and wait, fingers crossed, that their information isn't out on the web somewhere waiting to suck their bank accounts dry at any moment. No one really nows and quite possibly these people will have to run scared for years before they can think of taking their eye off their credit reports.

So what is the inequity? Well in one case we have the Secret Service involved, looking out for Hilton's back, working with T-Mobile to investigate and shutting down all sites that continue to propogate the information from her mobile. In the other well, the news of the fraud appears to have been buried for almost a year at the request of "federal authorities" in defiance of the California law that required ChoicePoint to notify everyone of the release of their personal information. Now ChoicePoint are just offering a free year of subscription to credit history monitoring services to those 145,000 is has, so far, identified as victims of the fraud. Apart from that little, if anything seems to be done about it and ChoicePoint appears to be washing its hands of the problem.

At least one person has already decided to hit ChoicePoint with a law suit and I can easily expect a class action suit to follow quite prompty, although being a multi-state case it is likely that it would fall fowl of Bush's recent anti-class action bill that forces it to be fought in class-action unfriendly federal courts. Wired News is now indicating they think such suits will fall on deaf ears, as courts have previously dismissed attempts to sue banks that have been duped by identity thieves on the grounds that the victim wasn't a customer of the company they were suing. Maybe that was just a badly presented suit that failed, but it certainly sounds like there should be a case to sue someone when a company that you didn't even ask to be holding your data screws up and hands it over to criminals.

Or is it, that just because we the people are many and not of celebrity status we dont get a personal investigation by the Secret Service, and in general we just get screwed because on average we don't have the time or resources to seek restitution in a court of law.

No comments: