ChoicePoint, ID theft and Californian Law

The dangers of large scale collections of private citizens' data became evident again today. As CNN and others have reported, U.S. firm ChoicePoint was tricked into disclosing information (names, addresses, Social Security Numbers etc.) about 140,000 people in the United States. ChoicePoint had initially denied that anything untoward had happened to its data, but a Californian law mandates it to disclose the problems it had by being tricked into by criminals who posed as customers. Apparently ChoicePoint was less than careful in ascertaining the identities of their customers. (See also the story on Slashdot here and here which claims that no less than 750 cases of identity theft have resulted from this).

This is ironic since ChoicePoint claims to have in its possession no less than 19 billion public records, including driving records, sex-offender lists and FBI lists of wanted criminals and suspected terrorists. It also maintains personal profiles of nearly every U.S. consumer, which it sells to employers, landlords, marketing companies and about 35 U.S. government agencies.

The Alpharetta, Ga.-based firm notoriously during the 2000 presidential election had given Florida officials a list with the names of 8,000 ex-felons to “scrub” from their list of voters. But it turned out none on the list were guilty of felonies, only misdemeanors.

Update: ChoicePoint's own information on the event is here. It confirms the number given above of so far 750 cases of identity theft. In addition, the webpage also gives a breakdown of cases on a state-by-state basis and the total as 144,778.

Further update: WiredNews reports that a Californian woman has filed the first lawsuit against ChoicePoint for fraud and negligence in this case. Maybe this will help establish some sort of data protection regulation in the private sector that (in an encompassing way) is so far lacking in the U.S. -- especially if this lawsuit is granted class-action status.

Yet another update: The Electronic Privacy Information Center has created a special webpage with information on the ChoicePoint case.