Privacy advocate, ACLU hit new Virginia privacy law as misguided

Computerworld - A Virginia-based privacy advocate who has been fighting to stop county and state governments from posting public records containing Social Security numbers on their Web sites is now preparing to do battle against an amendment to a Virginia law that bars individuals from disseminating any of those numbers, even if they obtain them legally from public records.

Far from viewing the bill that amended Virginia's Personal Information Protection Act as a cause for celebration, privacy advocate Betty "BJ" Ostergren claims that it violates her free-speech rights and will do nothing to stop county governments in the state from posting documents without first redacting Social Security numbers and other sensitive data. In fact, Ostergren said the measure seems to have been designed to curtail her campaign to publicize and end that practice.

Likely to join Ostergren in her effort to overturn the bill is the Virginia chapter of the American Civil Liberties Union, which previously had stated that it was willing to challenge the amended privacy law in court.

The bill, which was signed by Gov. Timothy Kaine last Tuesday, is scheduled to take effect July 1. Its prohibition on spreading Social Security numbers obtained from public records expands on an existing restriction that only applies to numbers contained in private documents.

According to Ostergren and other privacy advocates, county government Web sites in Virginia and elsewhere around the U.S. have become veritable treasure troves of sensitive data for identity thieves and fraudsters. Ostergren, who lives in Virginia's Hanover County, said the bill signed by Kaine will do little to prevent just about anyone worldwide from accessing the public records on county Web sites for a nominal fee. All the amended law does is prohibit people from spreading the information after it is made available to them, she contended.

Ostergren runs a Web site called The Virginia Watchdog, which she uses to highlight the privacy problems that she claims can result from the posting of unredacted tax lien records and other documents on government Web sites. In recent years, she has chronicled dozens of cases in which local governments have inadvertently exposed Social Security numbers and other personal data through their Web sites.

As part of her strategy to highlight the seriousness of the issue, Ostergren has routinely posted on her Web site the Social Security numbers of public figures that she accessed via government sites. The list includes former Florida Gov. Jeb Bush, former Secretary of State Colin Powell, former U.S. House Majority Leader Tom Delay, former Missouri senator Jean Carnahan and several of Virginia's county clerks. Ostergren claims that she posted the numbers to demonstrate the ease with which such information could be obtained and to pressure county officials into taking action.