Ohio recalls voter registration CDs; Social Security numbers included

Computerworld - The Social Security numbers of potentially millions of registered voters in Ohio were included on CD-ROMs distributed to some 20 political campaign operations in recent months as campaigns geared up for spring primary election races.

The problem was discovered Tuesday when one of the political campaigns contacted the Ohio secretary of state’s office to say that the personal data was on the discs, even though it wasn’t requested, said James Lee, a spokesman for Secretary of State J. Kenneth Blackwell.

All of the political organizations that received the CDs were immediately contacted and have agreed to return the discs for replacements that won’t include the Social Security numbers, Lee said. The records of about 7.7 million registered voters in Ohio are listed on the CDs, but Lee said he didn't know how many voter records included Social Security numbers. The records show which elections a voter participated in since 2002, along with their names and addresses.

For many years, Ohio voter registration forms included a space where the voter could choose to include a Social Security number, but it was optional, he said. Earlier this year, the forms were changed to include only the last four digits of the number to better protect a voter’s private information.

The Social Security numbers were included when the CDs were created, Lee said. “When we did one of our data merges, some data included some Social Security numbers” accidentally, he said. “It’s just a data issue that can be fixed now by leaving out that column.”

Once the affected CDs are returned sometime in the next two weeks, updated discs will be issued. Asked if any printouts from the CDs will also be returned or destroyed, Lee said he doesn’t believe any printouts were made. “We consider the issue resolved,” he said.

Political campaigns use the voter registration lists to conduct phone canvassing, create mailing lists for brochures about candidates and to put together door-to-door efforts.

This is the second time since March that the issue of privacy has arisen in Ohio government agencies. Last month, an Ohio man sued the state for posting his and other residents’ Social Security numbers for years on state Web sites where publicly searchable records are stored, showing retail purchases made using credit cards or bank loans (see ”Ohio secretary of state sued over ID info posted online”).

Lee Tien, a senior staff attorney for the Electronic Frontier Foundation, a San Francisco-based, nonprofit digital rights and privacy group, said the Ohio incident is particularly egregious because there has been no public notification of the data disclosure by state officials.