Identity theft was the most common complaint the Federal Trade Commission received in 2008, accounting for 26 percent of the year’s complaints. Anxiety and distress drive most ID theft allegations, because stolen personal information can be used to make fraudulent credit and debit card charges and open bogus bank accounts. But unless such actual injuries occur, an organization that loses personal data is not liable for damages or injunctive relief, according to the D.C. Circuit’s June 18 ruling in Randolph v. ING Life Insurance and Annuity Company.
The case stemmed from a June 11, 2006, burglary at the home of an ING Life representative who served participants in the District of Columbia’s deferred compensation plan. The thief stole the agent’s laptop computer, onto which he had downloaded plan participants’ personal information. The data allegedly was not encrypted or otherwise protected with a password (see “Encryption Prescription”).
