Who is protecting your date of birth? The obvious answer should be “you.” Who else is legally required to protect consumer birth dates in times when so many people have their date of birth visible on their Facebook page? Why is protecting your date of birth from public disclosure important? Two words–identity theft.
http://liarcatchers.com/identity_theft_investigation.html
Last week Pennsylvania’s Commonwealth Court overturned an order by the Pennsylvania Office of Open Records that ordered the release the date of births of all Pennsylvania State employees to The Philadelphia Inquirer as part of a right-to-know law request for a list of all state employees, their salaries and other employment information.
Pennsylvania’s Office of Administration (OA) originally released the information except they provided the year of birth instead of the full date of birth. The Philadelphia Inquirer sought release of the employee’s full date of birth.
The OA argued that release of the full birth dates was a risk to the personal security of the nearly 70,000 state employees. Affidavits of various experts agreed that the public disclosure of the information placed employees at risk of identity theft and related fraud and scams.
Commonwealth Judge Robert Simpson wrote the opinion, “Regardless of a general right to privacy, the clear language of the personal security exception in the Pennsylvania Right-to-Know Law protects information, including birth dates, to the extent that release ‘would be reasonably likely to result in a substantial and demonstrable risk … to the personal security of an individual.’”
Two affidavits discussing the risk of identity theft were critical to the court’s decision, one from Joseph Campana and another from Erik Avakian, the Office of Administration’s Chief Information Security Officer.
Campana wrote, “A person’s date of birth is one of the most sensitive pieces of personally identifiable information. For this reason, some identity theft experts have referred to a person’s name, Social Security number and date of birth, as “The Holy Trinity.” These three key pieces of information together can be used by identity thieves to establish new financial accounts in the name of the identity theft victim and to commit a variety of other types of identity fraud. While one cannot hold one’s name secret, one can often protect their Social Security number and date of birth …. Organizations that maintain records that contain consumer date of births must protect that personal identifier and other personally identifiable information that the consumer entrusted with the organization.”
Pennsylvania’s Erik Avakian affidavit stated, “divulging of a consolidated list containing birth date information for each employee would likely result in a substantial and demonstrable risk to the personal security of individual employees by creating such a significant and predictable increase in the amount of social engineering, targeted, and well-crafted phishing attacks (known as spear-phishing) against commonwealth employees.”
Both Avakian and Campana noted that various Federal and national standards classify birth dates as sensitive personal information and that disclosure of such information would result in a substantial and demonstrable risk to the personal security of individuals because the risk of identity theft. The risks are significant considering the large number of employees involved in the disclosure and the government current figures regarding the proliferation of identity theft and related crimes.
Most consumers and organizations do not think of dates of birth as a critical and sensitive piece of information.
To a large extent, the date of birth is taking over the role of the Social Security number. When your identity needs to be verified today, for example when getting health or medical care, you are asked for your date of birth since requesting Social Security numbers has become taboo.
