blog.zambit.com
My RSS Feeds
Just say NO ... to all requests for personal information.
posted Wednesday, 22 June 2005
From the I-have-to-laugh,-otherwise-I'd-cry department:
With all the hoopla lately about credit card processors being hacked and banks sending customers' personal information via common carrier (and getting stolen or lost), people are finally starting to wake up to the fact that maybe corporations are not the best entities to trust with your personal information.
The free-market capitalists argue that the solution to this problem is to not patronize companies that don't have adequate security of personal information. "The market will take care of itself." But there is a problem with that argument for the near term. As long as there is not a choice of a more secure alternative, there is no incentive to change. So consumers have to choose between surrendering personal information and giving up what have become common necessities. For example, it isn't impossible to live in the US without a bank account, but it's difficult. Fortunately, banks are highly regulated. Unfortunately, many of the companies who provide outsourced services are not. Hence the most recent theft of credit card data wasn't from the regulated companies, but from an unregulated processing company.
Some service companies have historically requested sensitive personal information because they need to extend some form of credit to you. Utility companies, telephone, and cable frequently require your SSN. However, they don't really need your social security number, they just want to be able to do a credit check. And they want a credit check so they can have some certainty that you will pay your monthly bills. However, you can give them this same level of certainty by giving them a nominal deposit (around $100) that they can hold onto for 6 months until you have proven your credit-worthiness. To me, the lost interest on the $100 (especially at the current rates) is well worth not giving my SSN to yet another entity that probably will not safeguard it to the extent that I think it should be secured. Not every company will give you this option, and those that do certainly don't advertise it. But it is done. You just need to ask for it and make it clear that they won't get the sale without it.
But what about other information such as middle name, phone number, address, driver's license number, date of birth, etc.? Believe it or not, these elements of information are also important in helping establish your identity, and if stolen from a company's database, can be paired with information stolen from another database to capture all of the relevant data needed to impersonate you and open accounts in your name (for which you are legally liable). As information becomes easier to obtain, and as more and more databases are made available online, single elements of information about you become more and more valuable because they are more likely to be the "missing piece" that someone needs to steal your identity.
Try this little exercise, the next time that you are trying to buy something, pay attention to what personal information these companies try to collect. Often they claim to "need" certain information like your date of birth or even a copy of your driver's license. But ask yourself "why do they need this information?" If you can come up with a good reason, then hand it over. From what I've noticed, though, most times they are collecting the information because someone back at "corporate" wants it in order to get a "better view of the customer" (read: we can make more money if we have more demographic information). The problem is that these companies don't/won't/can't properly safeguard that information once it is "given" to them. Unfortunately, if you say "no you can't have it" some companies say "then we won't sell it to you", whatever it is. That's all well and good if there is an alternative available that doesn't require you to give out this information, but as consolidation and collusion occur, the availability of these alternatives becomes seriously diminished.
In the last century, we needed unions to protect workers from the companies that were exploiting them. Now we need a union to protect consumers from the mega-corporations.
With all the hoopla lately about credit card processors being hacked and banks sending customers' personal information via common carrier (and getting stolen or lost), people are finally starting to wake up to the fact that maybe corporations are not the best entities to trust with your personal information.
The free-market capitalists argue that the solution to this problem is to not patronize companies that don't have adequate security of personal information. "The market will take care of itself." But there is a problem with that argument for the near term. As long as there is not a choice of a more secure alternative, there is no incentive to change. So consumers have to choose between surrendering personal information and giving up what have become common necessities. For example, it isn't impossible to live in the US without a bank account, but it's difficult. Fortunately, banks are highly regulated. Unfortunately, many of the companies who provide outsourced services are not. Hence the most recent theft of credit card data wasn't from the regulated companies, but from an unregulated processing company.
Some service companies have historically requested sensitive personal information because they need to extend some form of credit to you. Utility companies, telephone, and cable frequently require your SSN. However, they don't really need your social security number, they just want to be able to do a credit check. And they want a credit check so they can have some certainty that you will pay your monthly bills. However, you can give them this same level of certainty by giving them a nominal deposit (around $100) that they can hold onto for 6 months until you have proven your credit-worthiness. To me, the lost interest on the $100 (especially at the current rates) is well worth not giving my SSN to yet another entity that probably will not safeguard it to the extent that I think it should be secured. Not every company will give you this option, and those that do certainly don't advertise it. But it is done. You just need to ask for it and make it clear that they won't get the sale without it.
But what about other information such as middle name, phone number, address, driver's license number, date of birth, etc.? Believe it or not, these elements of information are also important in helping establish your identity, and if stolen from a company's database, can be paired with information stolen from another database to capture all of the relevant data needed to impersonate you and open accounts in your name (for which you are legally liable). As information becomes easier to obtain, and as more and more databases are made available online, single elements of information about you become more and more valuable because they are more likely to be the "missing piece" that someone needs to steal your identity.
Try this little exercise, the next time that you are trying to buy something, pay attention to what personal information these companies try to collect. Often they claim to "need" certain information like your date of birth or even a copy of your driver's license. But ask yourself "why do they need this information?" If you can come up with a good reason, then hand it over. From what I've noticed, though, most times they are collecting the information because someone back at "corporate" wants it in order to get a "better view of the customer" (read: we can make more money if we have more demographic information). The problem is that these companies don't/won't/can't properly safeguard that information once it is "given" to them. Unfortunately, if you say "no you can't have it" some companies say "then we won't sell it to you", whatever it is. That's all well and good if there is an alternative available that doesn't require you to give out this information, but as consolidation and collusion occur, the availability of these alternatives becomes seriously diminished.
In the last century, we needed unions to protect workers from the companies that were exploiting them. Now we need a union to protect consumers from the mega-corporations.
comments