Texas Attorney General Greg Abbott has sued Radio Shack for violating state laws regarding the protection and destruction of personal information, after employees at a store in Portland, Texas, dumped thousands of records outside the store, exposing the customers to identity theft.
Abbott's office published an example of the records on their Web site--a receipt of purchase for a shredder, ironically bought by a woman who wanted to protect herself from possible fraud. Other information found in the records included Social Security numbers, credit and debit card numbers, names, and addresses, according to investigators.
Under Texas' "Identity Theft Enforcement and Protection Act" of 2005, businesses can be charged $50,000 for each potential violation. In addition, Abbott charged Radio Shack with violating Chapter 35 of the state's Business and Commerce code, which requires businesses operating in Texas to develop and maintain procedures for retaining and disposing of customer data. Each exposed record could cost the retailer $500.
Radio Shack spokespersons said the incident was not typical, and that stores are required to shred customer information as part of a chain-wide policy. Retailer representatives pledged to work with Abbott's office to resolve the issue.
Abbott had been recently campaigning to stop Texas court and county clerks from posting Social Security numbers online, saying it was a violation of state and federal privacy laws. His efforts were thwarted when Governor Rick Perry signed into law on April 2 a bill permitting clerks to post information containing Social Security numbers "in the normal course of business."
Abbott was also among the first to sue electronics giant Sony for embedding harmful software "rootkits" in copy-protected CDs, which could not be removed from users' computers and exposed them to outside hacks.
The Dangers of Data Dumping
Careless disposal of personal information is one of the leading factors contributing to identity theft. Thieves and fraudsters will spend hours rifling through trash looking for credit card solicitations, receipts, canceled checks -- anything with enough personal information on it to be sold and reused to create new "synthetic" identities and open false accounts.
J.P. Morgan Chase was criticized for accidentally destroying personal data on accountholders of co-branded Circuit City cards in September 2006. The tapes were allegedly buried in a landfill.