Small business urged to protect data
Print
Email
Save
Reprints
Twitter
Share
Del.icio.us
Digg
Facebook
Reddit
Just because you run a small business doesn’t mean you don’t have to worry about safeguarding customers’ and employees’ personal information.
That was the lesson Deanya Kueckelhan delivered to the Better Business Bureau at its annual meeting Tuesday.
Kueckelhan, the director of the Federal Trade Commission’s southwest region, said personally identifiable information is a Social Security number by itself or any two pieces of other identifying information, such as an address, an account number or a phone number. Kueckelhan said the FTC suggests companies follow several steps to make sure they keep information safe.
First, they should take stock of the personal information they collect, where it’s stored and who has access to it.
Second, they should scale down what they collect if they take in more than they need. If you don’t have a need for sensitive personal information, she said, don’t keep it.
Third, they should take steps to protect the information they keep and make sure they have a data retention policy outlining how long information is kept.
Fourth, they should dispose of personal information properly, such as shredding paper documents.
And last, they should prepare a plan to deal with a security breach in case one happens.
Kueckelhan also discussed the Red Flags Rule, which the FTC has been enforcing since the beginning of 2008. The rule requires “financial institutions and creditors” to adopt policies designed to identify red flags about potential identity theft.
But Kueckelhan pointed out that “creditor” is a deceptively narrow term that actually includes any business that regularly defers payment for a good or service, which is actually quite broad and includes many businesses who might not think they need a plan.
In cases where companies have a security breach and can’t show they had a plan in place to help notice potential scams, Kueckelhan said the punishment can be severe — 20 years of monitoring with audits every other year.
“We mean business,” she said.
But the main reason to protect personal information, she said, is that “customers are counting on you” and losing it can be devastating for business.
Visit the FTC’s Web site at http://www.ftc.gov.
 | ||||
| Most Popular | Most Emailed | Hot Topics | ||
