Simon Says – Musings of a Technology CTO

A knock to the campaign to ensure companies take better care of our personal data occurred this when when John Amburgy lost his case against Express Scripts in Missouri, USA.

John alleged that he had spent significant time and effort in protecting

his identity following Express Scripts’ breach back in October 2008. They offered free credit report monitoring services to the people who’s PII/PHI they lost, but only to those who proved they had been victims of identity theft.

Yes, it seems you have to be a victim of identity theft because of Express Scripts breach before Express Scripts will offer you help in protecting and monitoring your identity…

The Judge, Frederick R. Buckles commented:

In short, plaintiff does not claim that his personal information has in fact been stolen and/or his identity compromised, rather, plaintiff surmises that, as a result of the security breach, he faces an increased risk of identity theft at an unknown point in the future.

Judge Buckles also pointed out that John was not entitled to timely notification of the disclosure of his information, because at that time Missouri had no data breach legislation (HB62 was signed into effect in July 2009, but has a “material risk of harm” trigger. Interestingly, it’s one of the few laws which specifically state that encryption of data is a mitigating technology).

All in all, not very supportive of the individuals rights to have OUR information (after all, PII and PHI belongs to you and me, not to the companies we let use it), but there is a potential silver lining on the horizon – S1490, the “Personal Data Privacy and Security Act of 2009” has moved out of the Senate Judiciary Committee.

That does not mean it’s absolutely going to become law, but it’s a massive step towards the USA having unified data privacy and security legislation, rather than the hodge-podge of State Law we have at the moment.