Federal law puts employers at risk of heavy penalties for data breaches involving employees' or customers' sensitive information. Identity theft costs financial institutions and businesses $67.5 billion annually, which consumers pay for through increased prices. The Fair and Accurate Credit Transactions Act regulates how companies must handle sensitive data and has resulted in severe penalties against companies whose data breaches exposed customers to identity theft risks. Companies can reduce their risks and legal liabilities by appointing a compliance officer, creating written identity theft policies, training employees, and offering credit monitoring to individuals affected by any data breach.

1. Identity Theft Law Puts Employers at
Increased Risk for Heavy Penalties
An Expert Offers Compliance Advice
“The cost to financial institutions and other businesses was
$67.5 billion in 2007. As consumers, we pay for those losses
with added costs for goods and services.”
–­Royce­McCoy,­
Certified­Identity­Theft­Risk­Management­Specialist™
There­is­no­crime­as­profitable,­with
so­ little­ risk­ of­ being­ caught,­ as
identity­ theft.­Theft­ of­ credit­ card
numbers­and­personal­information
such­as­social­security­numbers,
driver’s­licenses,­and­medical­I.D.
cards­is­common­as­major­targets.
Criminals­who­steal­such­data­can
sell­ it­ countless­ times­ to­ other
crooks,­each­of­whom­can­use­it­to
pilfer­funds­from­bank­accounts,­run
up­credit­card­bills­or­obtain­medical
services.­Clearly,­the­damage­done
to­victims­is­not­just­financial;­it­can
be­ life-threatening­ when­ false
medical­information­winds­up­in­a
victim’s­real­medical­file.
Shockingly,­ the­ risk­ of­ being
prosecuted­ for­ identity­ theft­ is­ a
paltry­ 1­ in­ 700.­ No­ wonder­ it­ is
America’s­fastest­growing­crime.
“The­ cost­ to­ financial­ institutions
and­all­other­businesses,­large­and
small,­ was­ $67.5­ billion­ in­ 2007,”
says­ Royce­ McCoy,­ a­ nationally
recognized­expert­in­identity­theft
and­privacy­issues.­“As­consumers,
we­pay­for­those­losses­with­added
costs­for­goods­and­services.”
The­ Federal­ Trade­ Commission
(FTC)­ enforces­ the­ Fair­ and
Accurate­ Credit­ Transactions­ Act
(FACTA).­ The­ FTC­ has­ levied
severe­ penalties­ against­ com-
panies­ whose­ employees’­ or
customers’­ sensitive­ information
was­lost­or­stolen. FACTA­has­no
statute­of­limitations­and­lawsuits
are­ frequently­ brought­ as­ class
actions­in­which­punitive­damages
are­sought.­­In­addition­to­paying
actual­damages,­many­companies
are­ encouraged,­ by­ identity­ theft
experts­ such­ as­ Mr.­ McCoy,­ to
obtain­identity­monitoring­for­those
whose­ sensitive­ information­ was
compromised.
A­national­shoe­store­chain­lost­the
credit­card­numbers­of­1.4­million
customers.­ A­ major­ health
insurance­ company­ lost­ medical
records­of­365,000­insured.­Even
the­ federal­ government­ is­ not
immune­from­its­own­law.­When­the
Veterans­ Administration­ lost
medical­ records­ of­ 26­ million
individuals,­the­government­had­to
set­ aside­ $20­ million­ to­ settle
possible­claims.
“The­VA­sent­over­26­million­letters
notifying­potential­victims,”­McCoy
says.­“Who­do­you­think­paid­for­all
those­envelopes­and­postage?­The
taxpayers!­But,­in­the­private­sector,
it’s­the­company­that­foots­the­bill.”
McCoy’s Advice
to Companies
McCoy,­a­former­judge­from­East
Texas,­ is­ a­ nationally­ recognized
Certified­ Identity­ Theft­ Risk
Management­Specialist™.­­He­has
consulted­ for­ companies­ through
out­ the­ United­ States­ and
addressed­chambers­of­commerce,
employers­ and­ law­ enforcement
organizations­nationwide.
“As­ technology­ to­ guard­ against
identity­ theft­ becomes­ more
sophisticated,­so­do­the­criminals,”
McCoy­says.
Of­course,­there­also­is­the­human
factor,­in­the­form­of­the­occasional
disgruntled­employee­who­is­willing
to­sell­driver’s­license­information,
social­ security­ numbers,­ medical
I.D.s­and­other­personal­data.
“Every­company­must­now­have­a
compliance­ officer­ to­ deal­ with
these­issues­promptly,­as­required
by­ FACTA,”­ he­ advises.­ “It’s­ also
now­ required­ by­ federal­ law
(FACTA)­to­have­a­written­policy­in
place.­ Employees­ must­ also­ be
properly­trained­in­the­company’s
written­ I.D.­ theft­ policies­ and
procedures.­ It’s­ important­ for
companies­to­continually­evaluate
programs­ and­ create­ mitigation
plans­that­include­credit­monitoring,
restoration­ and­ access­ to­ legal
counsel.­Identity­theft­needs­to­be
dealt­with­aggressively­instead­of
waiting­for­the­financial­nightmare
to­begin.”
­­­Royce McCoy is­ a­ fifth­ gen-
eration­Texan.­He­grew­up­on­the
Texas­Gulf­Coast­and­attended
the­ University­ of­ Houston.­ He
was­ elected­ County­ Judge­ in
November­ 2002­ and­ presided
over­the­County­Court.
He­co-founded­Alliance­USA­in
1993,­in­1995,­he­was­nominated
as­one­of­three­finalists­for­the
prestigious­“Entrepreneur­of­the
Year”­ award­ sponsored­ by­ Inc.
Magazine,­ Merrill­ Lynch­ and
Ernst­&­Young.
Judge­ McCoy­ is­ a­ Certified
Identity­Theft­Risk­Management
Specialist­(CITRMS)­through­the
prestigious­ Institute­ of­ Fraud
Risk­Management­and­speaks­to
groups­across­America­regarding
identity­theft.
judge@USidtSolutions.com
www.USidtSolutions.com
972-548-8550
The 5 Areas of Identity Theft
Driver’s License Criminal Records
Social Security Numbers Financial Records
Medical Record