Jonathan Murray was fishing in a trash container for boxes Friday when he found what could have been a thief's bonanza.
Amongst the trash from a Blockbuster video store were membership forms and employment applications that included names, addresses, credit card numbers and Social Security numbers.
"The sad part is that even after I told Blockbuster about it, I went back the next day to go get some more boxes, and this time I found credit card stuff," said Murray, a Sarasota resident.
Federal and state officials said no law was broken in the incident, but Florida law puts the onus on Blockbuster to inform its customers of the security lapse.
"There is a statute that requires businesses who maintain records and databases with consumer personal identification to alert them if their information has been breached or hacked," said Sandi Copes, spokeswoman for the attorney general's office. "They do have to reach out to consumers."
Two federal laws protect consumer information involving credit reports as well as information going to financial institutions but do not apply in this case.
The paperwork that was available to anyone chancing to peer into the trash container included information that in the wrong hands could easily translate to identity theft, experts say. Identity theft is the fastest growing crime in America, with financially devastating results for some 10 million victims each year, according to the the Federal Trade Commission. On average, victims of the crime spend 350 hours and two years rebuilding a secure identity.
"That is what's driving state and federal legislators to pass privacy laws," said David Reed, owner of ShredQuick, a Sarasota firm that specializes in disposal of sensitive information.
Officials at Blockbuster say they tried to reach Murray beginning on Saturday and that customer privacy is a priority.
"According to our corporate policy, documents generated in store, including customer information, must be destroyed when no longer kept on file," said Randy Hargrove, spokesman for Blockbuster Inc.
The company is conducting its own investigation into the matter, he said. Those responsible are subject to disciplinary action up to being fired.
Copes said the attorney general's office would follow up on the incident and wants to hear from Murray.
Murray is giving the documents to the Sarasota County Sheriff's Office, which will keep the records pending an investigation, said Lt. Chuck Lesaltato, sheriff's spokesman.
"Our concern is that we don't want these things on the streets," he said.
Terri Smith's membership application for the store that included her name, address, phone number and credit card information was among some 400 other documents with people's personal data.
Smith, a Sarasota resident, said she never gave much thought to identity theft or what happens to information once she gives it to a company such as Blockbuster, but that has changed.
"I'll be a little more protective giving it out," she said.
Reed, who keeps up with news about privacy breaches, said businesses that dispose of credit card receipts and documents similar to those left in Blockbuster's trash are a target of thieves, who all too often find what they are looking for.
But he said business owners, whether they choose to shred documents themselves or rely on an outside vendor, should know better.
"You're in business," he said. "You're supposed to know certain things. You can't just throw away people's private information."