Outraged by last week's announcement by the Transportation Security Administration (TSA) that it lost an external hard drive containing as a many as 100,000 archived employee records (including social security numbers, birth dates, payroll, and bank account information), the American Federation of Government Employees (AFGE) has filed a class action lawsuit against the agency.
The AFGE, which represents numerous employees in the Department of Homeland Security, alleges that the TSA violated both the Aviation and Transportation Security Act (ATSA) and the Privacy Act of 1974. "TSA's reckless behavior is clearly in violation of the law," AFGE National President John Gage declared. "TSA must be held liable for this wanton disregard for employee privacy."
The AFGE is seeking several remedies: the creation of new security procedures to comply with the requirements of the Privacy Act and the ATSA; time off without penalty for any TSA employee who needs to deal with identity theft resulting from the equipment loss; and compensation for any financial damages suffered by TSA employees as a result of the TSA's alleged violation of the Privacy Act.
Uphill Battle for Employees
Lew Maltby, the President of the National Workrights Institute in Princeton, N.J., predicted that it would be a challenging case for the AFGE. "This is the kind of case that you don't see very often," Maltby said. "The law in this area is not particularly good. If you want to enforce better employer care for private data, you need a law that imposes a duty on them to do so, and it's not clear that these laws do that."
Even before the lawsuit was filed, the TSA announced that it is offering its employees a free year of credit monitoring, up to $25,000 in free identity fraud insurance, and the services of identity restoration experts in the event that theft does occur.
When asked about the track record of employers in protecting employee information, Maltby gave a grim chuckle. "What care?" he asked. "Employers and other large organizations have an atrocious record regarding private record confidentiality. If the AFGE employees win this lawsuit, that would help, but strong privacy legislation would be better."
National Security Implications
The loss of the TSA hard drive is particularly problematic because of the possibility that the employee information could be used to create false Homeland Security credentials. As AFGE President Gage put it, "The maintenance and safeguarding of personnel data is vital to the protection of security at our nation's airports. This is the Department of Homeland Security we are talking about. A DHS agency that cannot even shield its own employee data is not reassuring."
According to a statement issued by the TSA, the agency has been working with the Secret Service since last Friday to investigate the loss of the hard drive, and the Inspector General of the Homeland Security Department is closely monitoring the investigation, with measures in place to alert the TSA if someone attempts to use the hard drive. Those measures have not been specified.