<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN">
<HTML><HEAD>
<META http-equiv=Content-Type content="text/html; charset=us-ascii">
<META content="MSHTML 6.00.6000.16544" name=GENERATOR></HEAD>
<BODY>
<DIV dir=ltr align=left><SPAN class=140380412-07122007>Hi Rodney,</SPAN></DIV>
<DIV dir=ltr align=left><SPAN class=140380412-07122007></SPAN> </DIV>
<DIV dir=ltr align=left><SPAN class=140380412-07122007>Not all states have the
privacy laws enacted. The link below describes the Pennsylvania law
that went into effect in 2006:</SPAN></DIV>
<DIV dir=ltr align=left><SPAN class=140380412-07122007></SPAN> </DIV>
<DIV dir=ltr align=left><SPAN class=140380412-07122007><A
href="http://www.privsecblog.com/archives/state-legislation-pennsylvania-becomes-22nd-state-to-enact-a-data-breach-disclosure-law.html">http://www.privsecblog.com/archives/state-legislation-pennsylvania-becomes-22nd-state-to-enact-a-data-breach-disclosure-law.html</A></SPAN></DIV>
<DIV> </DIV>
<DIV align=left>Thank you,</DIV>
<DIV align=left> </DIV>
<DIV align=left>Dale Jordan<BR></DIV>
<DIV> </DIV><BR>
<DIV class=OutlookMessageHeader lang=en-us dir=ltr align=left>
<HR tabIndex=-1>
<FONT face=Tahoma size=2><B>From:</B> dataloss-bounces@attrition.org
[mailto:dataloss-bounces@attrition.org] <B>On Behalf Of
</B>Rodney<BR><B>Sent:</B> Thursday, December 06, 2007 8:21 PM<BR><B>To:</B>
dataloss@attrition.org<BR><B>Subject:</B> Re: [Dataloss] Personal Info >From PA.
Welfare Rolls Stolen<BR></FONT><BR></DIV>
<DIV></DIV><BR>On Thu, 2007-12-06 at 18:50 -0600, Henry Brown wrote:<BR>
<BLOCKQUOTE type="CITE"><TT><FONT color=#000000>The Department of Public
Welfare began mailing letters Wednesday warning </FONT></TT><BR><TT><FONT
color=#000000>the recipients to take steps to protect themselves from identity
theft, </FONT></TT><BR><TT><FONT color=#000000>agency spokeswoman Anne Bale
said.</FONT></TT><BR></BLOCKQUOTE><BR>This strikes me as odd and I have a couple
of questions for the group.<BR><BR>1. If your data is lost and there is a clear
"at fault" party as seems to be the case here (the data was unencrypted) they
isn't the "at fault party supposed to provide ID theft protection? Is that a law
or just something done to reduce damages should they ever be sued over release
of personally identifiable information without informed consent?<BR><BR>2. If it
is welfare rolls, then these people can't afford to do this on their own, so
again why isn't the state setting this up for them?<BR><BR>Rodney Wise
</BODY></HTML>