Ohio secretary of state sued over ID info posted online

The inclusion of residents’ Social Security numbers online is being challenged

An Ohio man is suing the Ohio secretary of state for posting his and other residents’ Social Security numbers for years on state Web sites where publicly searchable records are stored, showing retail purchases made using credit cards or bank loans.

The Social Security numbers are included in online records of purchases of high-ticket items such as boats, garden tractors, furniture or other goods. Such secure purchases are often registered with the state using Uniform Commercial Code (UCC) filings to protect creditors in the event a buyer does not pay for the merchandise.

Secretary of State J. Kenneth Blackwell’s office posts the UCC filings on the Web, and the data sometimes includes Social Security numbers.

A spokeswoman for Blackwell, a Republican, today refused to comment on the matter.

Cincinnati attorney Christian Jenkins, who filed a class-action lawsuit yesterday on behalf of his client, Darrell Estep, of Mount Orab, Ohio, said Blackwell has refused to remove the Social Security numbers and won’t block them so they can’t be read online.

The online UCC forms have been used for years, he said, but they don’t note that the inclusion of the Social Security numbers is optional, he said.

Estep’s UCC forms were filed by his lenders after he purchased a trailer in 2002, flooring for his home in 2003 and a riding mower in 2004 -- all using secured credit, according to the lawsuit. Each of the UCC forms included a space for his Social Security number, which was filled in each time.

“Publishing documents containing individual names and Social Security numbers on the Internet and allowing unfettered, anonymous access to such documents from anywhere in the world creates a serious and high risk of identity theft,” the lawsuit states. Some 10,000 persons may have their Social Security numbers filed in UCCs on the Web site, according to the lawsuit.

The eight-page lawsuit claims that Blackwell violated Estep’s rights to privacy, personal security and due process by posting the information. The suit asks that such information be permanently removed from the site and from other publicly-available records in the agency’s offices.

Jenkins said he filed the lawsuit after Blackwell refused to remove or hide the information online.

Another official, Senate Minority Leader C.J. Prentiss, a Democrat, this week criticized Blackwell on the issue, arguing that he is putting state residents at risk. “This is sensitive information we are dealing with,” she said in a statement yesterday. “Anyone who has access to a computer in any part of the world can tap in and use the numbers to defraud Ohioans.”

The issue is gaining attention in the state because security experts recommend that Social Security numbers be closely guarded to protect against identity theft.

In a statement yesterday, Ohio Attorney General Jim Petro said Blackwell should by law remove the Social Security number. “We believe he should immediately notify every person whose Social Security number was posted on his Web site, regardless of whether he believes citizens offered the information voluntarily,” Petro said. “We also believe he should immediately remove files from his Web site that display citizens’ Social Security numbers and redact that information before re-displaying it on the site.”

Petro said the Ohio Supreme Court has ruled in numerous cases that residents have a right of privacy related to their Social Security numbers, and their release by a public office is prohibited by federal law. A state court case earlier this week emphasized that “public records custodians should redact Social Security numbers from otherwise public records before disclosing [them]” under existing law, he said.

In December, Petro issued a formal opinion on the matter, advising a prosecutor in Richland County, Ohio, that a clerk of court has a duty to follow the privacy practice. “Because individuals possess a constitutionally protected privacy right in their Social Security numbers, such numbers when contained in a court’s civil case files are not public records for purposes of [state law],” Petro wrote. “Prior to releasing information from a court’s civil case files, the clerk of court has a duty to redact Social Security numbers included in those files.”

The neighboring state of Kentucky does redact such information in publicly available records, according to Petro.

Petro and Blackwell are running against each other in this year’s GOP primary for governor.

Computerworld's IT Salary Survey 2017 results
Shop Tech Products at Amazon