Preventing Identity Theft throughout the Data Life Cycle
EXECUTIVE SUMMARY * CPAs and their clients or corporate employers are susceptible to privacy breaches, leaving their customers and employees at risk of identity theft. * Data may lose its value to an organization, but it may not lose value to identity thieves. If aging data contains personal information (PI), such as Social Security numbers, the value does not diminish over time. Organizations that protect only newer PI are placing their former and current customers at risk. * Personal information is at risk during all phases of the data life cycle, and the possession of unnecessary personal information is a potential liability. * Although the risk of a privacy breach can be reduced, it cannot be eliminated. Companies and CPA firms that collect, use or store PI should have well-planned and documented response strategies. When a breach occurs, an organization needs to act quickly. * Knowledgeable CPAs can leverage the principles and criteria in the AICPA's Generally Accepted Privacy Principles (GAPP) to help reduce the negative consequences of data breaches. ********** The Federal Trade Commission estimates that as many as 9 million people have their identities stolen every year. According to the Privacy Rights Clearinghouse, more than 200 million instances of data breaches have occurred since the beginning of 2005, and they show no signs of letting up. In the first quarter of 2008 alone, more than 85 million incidents were reported. The causes of data breaches run the gamut: Hackers get unencrypted, transmitted data and data at rest; laptops are stolen or lost; storage devices are lost by third-party shipping companies; flash drives or PDAs are left lying around; Social Security numbers are accidentally printed on envelopes; or data is found on discarded computers. This article examines the organizational risks to CPAs and their clients or corporate employers of improperly managed data throughout the data life cycle. It also discusses best data management practices and proper procedures for responding to a data breach. [ILLUSTRATION OMITTED] Data breaches, whatever the cause, are costly. According to a study by the Ponemon Institute, the average cost of a data breach in 2007 was $6.3 million. The average cost to an organization per record compromised is about $197, which is typically spent on phone calls for customer notification, providing free credit monitoring, discounts on membership fees, or discounts on merchandise to make up for the security breach. Some organizations also experience an increase in customer turnover. The organization typically spends additional money in data protection enhancements. Companies sanctioned by the FTC may also have the added cost of security audits that must be performed every two years for the next 10 to 20 years. DATA LIFE CYCLE MANAGEMENT Data life cycle management (DLM) includes all of the processes involved in managing the flow of data throughout its life cycle: from creation to when it has lost its business value or is required by law to be deleted. Although data may lose its value to an organization, in many cases, it does not lose value to identity thieves. If aging data contains personal information (PI), such as Social Security numbers, the value does not diminish over time. Organizations that protect only newer PI with the latest encryption and privacy enhancing technologies are placing their former and current customers at risk. They need to diligently protect all PI, regardless of age and storage medium. As data storage costs continue to decrease, many organizations mistakenly believe little cost incentive exists to periodically purge old PI. However, from an identity theft prevention perspective, if the PI is no longer relevant for the original purpose for which it was stored or is not part of audit or other regulatory requirements, the organization should purge it. …