William W. Bowser, Editor; Scott A. Holt and Adria B. Martinelli, Associate Editor
Young, Conaway, Stargatt & Taylor

Vol. 13, No. 7
July 2008

CONFIDENTIAL INFORMATION

Identity crisis: how to respond to a data breach

Would you know what to do if your employees' confidential data was stolen or lost? There are ways you can prepare yourself to act quickly and effectively in the event of a data security breach. Delaware employers in particular have a wealth of resources available from the state. But don't wait until it's too late to learn about the necessary steps to take to help your employees in a time of crisis as well as to protect against liability.

Notify your employees immediately

As soon as you learn about a potential data breach, you should notify every potentially affected employee. Do it immediately. Every minute counts when highly confidential information has made it into the hands of someone with the wrong intentions.

Exactly how you give notice may differ based on the state where your business is located. Delaware employers are guided by a state law, the Delaware Credit and Identity Theft Protection Act, which instructs you to provide written notice to employees that the security of their data may have been breached. The Act also contains sample language for the notice. It's wise to use that language verbatim.

In addition, the Act explains that employees should consider placing a "security freeze" on their credit report. A security freeze is a permanent hold on your credit information. It costs nothing to have the security freeze put in place, and it takes no more than three days from the time the request is made. If someone tries to use your credit to get a loan, extend a line of credit, or finance a big purchase, the lender will need to contact a credit- reporting agency to determine your credit rating.

If a freeze is in place, no information will be provided. But you'll be alerted, and you can, in turn, alert the authorities. And unlike a fraud alert, which is another commonly used option, a security freeze will stay in place until you ask to have it removed permanently or lifted temporarily.

Monitor your credit report

Another important step to take is to request a copy of your credit report at least every 12 months and cautiously monitor it for any inaccuracies. By law, Delaware residents are entitled to one free credit report per year from each of the three credit agencies. The website created for this purpose is www.annualcreditreport.com. Or you can download the free credit request form and mail a completed copy to Annual Credit Report Request Service, P.O. Box 105281, Atlanta, GA 30348-5281.

There's no credit penalty for Delaware residents who request their credit report or who put a security freeze on their credit.

Use the resources offered by the state

Preparedness is just as important as prevention when it comes to identity theft. There are numerous ways to assist employees and protect your business from liability, but only if you know what to do and then do it quickly. Delaware employers in particular have a wealth of resources made available by the state.

For example, the new brochure "Identity Theft Hurts" has answers to many questions about credit reports, including what's in your credit report and what to do if you find an error in your report. The brochure also covers identity theft and the steps to take if you're a victim of that crime. It's a great idea to order some copies of the pamphlet now to have on hand if a theft does occur.

In addition, the Office of the State Bank Commissioner distributes a new brochure from the Federal Trade Commission titled "Stop, Think and Click" (also available in Spanish), which highlights seven practices for safe computing. The material also focuses on a new website called onguardonline.gov, which provides practical tips from the federal government and the technology industry to help you guard against Internet fraud. The Office of the State Bank Commissioner recently released links to the top five websites consumers can use to fight identity theft.

You can research identity theft or any other employment law topic in the subscribers' area of www.HRhero.com. Access to this online library is included in your newsletter subscription at no additional charge.

Copyright 2008 M. Lee Smith Publishers LLC

DELAWARE EMPLOYMENT LAW LETTER does not attempt to offer solutions to individual problems but rather to provide information about current developments in Delaware employment law. Questions about individual problems should be addressed to the employment law attorney of your choice.