[Dataloss] Wis. mailing sent with personal info

[Chris Walsh]

EDS is a major provider of outsourced IT.  They may well have a more  
general contract and, in effect, made this decision themselves.  The  
SSNs would have been given as part of the larger scope of work, and  
then improperly used.

<RUMSFELD>
Is this a risk firms take when they outsource?  Heavens to Betsy, yes.
Should Wisconsin have anticipated this?  Great Caesar's ghost they  
should have.
Does Wisconsin not have an information classification policy to which  
3rd parties must adhere?  By jiminy, I would hope so.
</RUMSFELD>

On Jan 10, 2008, at 2:57 PM, Adam Shostack wrote:

> Appalled experts elsewhere are asking why Wisconsin gave SSNs to EDS
> as part of mailing informational brochures.
>
> You don't have to select * from row.  You could have selected name,
> address from row.