Governor Doyle’s Response to Report on Safeguarding Sensitive Information A Good First Step

ACLU Says “Data Creep” Threatens State Information

MILWAUKEE – Today, the American Civil Liberties Union of Wisconsin praised Governor Doyle’s initial response to a set of recommendations regarding the state’s information security practices.  However, it cautioned that neither the Governor nor the report considered whether or not sensitive information is compromised when it is collected, stored, and used for unintended purposes. 

Metavante Corporation of Milwaukee also should be commended for preparing a high level overall assessment of the State’s practices for safeguarding sensitive information at Governor Doyle request without charge.  

“Metavante’s assessment deals with security issues for the most part.  As far as it goes it suggests several recommendations that are worth pursuing, such as a privacy officer in each state agency.  However, it is misleading to call it a privacy assessment, which would properly evaluate if sensitive information is gathered and used correctly,” said Chris Ahmuty, Executive Director of the ACLU of Wisconsin. 

“While the report recommends establishing a global data classification program, it does not ask if the State is making security more difficult and expensive by collecting and using too much personally identifiable information.  The ACLU of Wisconsin recognizes that the State gathers vast amounts of data legitimately, but history has shown that legitimately collected data is often used for secondary and tertiary uses that were unintended originally, much less consented.  Data creep makes large databases, such as fishing or drivers’ licenses, less secure,” Ahmuty contended.      

Metavante issued its report on April 15, 2008.  The Governor’s request followed two security breaches in January, when a state contractor, EDS Corp. and a state agency, the Department of Revenue sent out mailings to over 260,000 residents in which Social Security Numbers were visible on the address label or through the address window.

“The ACLU of Wisconsin intends to monitor the implementation of these recommendations and to press for consideration of data privacy principles as programs and  policies are developed for the State and its agencies,” Ahmuty concluded.

The ACLU of Wisconsin is a membership organization dedicated to defending the civil liberties and civil rights of all Wisconsin residents.  It has nearly 8,500 members statewide.

For more information see article in The Wisconsin State Journal.