[Dataloss] [update] Social Security data puts 1.3 mil. voters at risk: suit

[Dissent]

Out of curiosity:  Can the Board of Elections really use mass
advertising to satisfy the breach notification requirements -- or do
they have to make some effort to notify individually? Anyone have a
copy of IL's statute handy?

And anyone want to bet that the Bd. will use the 'no harm, no foul'
defense that's worked so well for Acxiom and Wells Fargo? I'm thinking
that they might even argue that they don't need to provide free credit
monitoring because it's already been three years since the breach.

/Dissent

---------------
http://www.suntimes.com/news/politics/224519,CST-NWS-data23.article

The release of more than 1.3 million registered voters' Social
Security numbers by the Chicago Board of Elections has triggered a
class action lawsuit, which was filed Monday in County Circuit Court.

Lead plaintiff in the suit is 43rd Ward aldermanic candidate Peter
Zelchenko, who discovered the security breach and who also uncovered a
similar problem last October on the board's Web site. The most recent
release of at least 100 compact discs to alderman and ward
committeemen, with another six discs unaccounted for, was revealed on
Monday in the Sun-Times.

The suit, filed by attorney Nicholas Kefalos, alleges the board
violated the Illinois Personal Information Protection Act and seeks
unspecified compensation for all Chicago voters whose Social Security
numbers were disclosed.

"Actual damages could be $50 or $100 for each person to at least
establish a credit watch," Kefalos said.

The CDs also included birth dates, phone numbers and addresses.

"You couldn't have come up with a better threat for identity fraud if
you had orchestrated it," Zelchenko said.

Law requires notification

But board spokesman Tom Leach said most of the CDs were distributed
three years ago, and that since then there has been "absolutely no
evidence" of identity theft.

"We don't want the message to get out that there should be panic in
the streets," Leach said.

The board is attempting to retrieve the discs.

Though required by law to notify voters of the breach, Leach said the
board will not do so individually, but will instead advertise.

So, right now, voters have no way of knowing whether their information
was exposed.

But since the board stopped collecting full Social Security numbers
about three years ago, those who registered earlier are at greater
risk.

Plaintiff's site may aid voters

Kefalos said that people who register with Zelchenko's Web site,
Re4m.org, will be notified if their Social Security numbers were
exposed as soon as the courts give permission.

He intends to file a similar suit in federal court today.

In a separate action, other class action lawsuits were filed against
the Chicago Board of Elections in Cook County and federal courts by
Meliza Aldea, Romeo Aldea and Robert Green, noting concerns about
privacy rights.

-- 
Privacy-related news and resources: http://www.pogowasright.org
Privacy news headlines feed:
http://www.pogowasright.org/backend/pogowasright.rss