>>Maybe enforcement of these policy documents<<

Here's a thought.  When everyone wanted to distance themselves from AA
after the Enron episode, folks dropped them like a hot potato.  Maybe
organizations should do the same with external organizations that treat
confidential data so carelessly.  

If I was a CEO of Armstrong in this case, I would be looking for the
head of the auditing firm to be delivered on a platter.  I hired the
auditor in good faith and their failure to protect confidential
information has cost my organization significant good will, employee
confidence, and a bunch of money.  I would publicly announce termination
of their contract and search for a replacement.

A couple of instances like this would get folks attention.  Then again,
sooner or later one of these thefts is going to result in stolen
identities.  When it does, a class action suit against the company and
whoever carelessly handled the data could be worth millions to some
enterprising attorney and the class representatives.  Maybe that's what
it will take.

Bill R

Bill Roach, CRM
Enterprise EDMS Coordinator
State of North Dakota
ITD/Records Management
701-328-3589


 

List archives at http://lists.ufl.edu/archives/recmgmt-l.html
Contact [log in to unmask] for assistance