"FEMA Did Not Safeguard Disaster Survivors’ Sensitive Personally Identifiable Information"

Affected: 2.3 million victims of hurricanes Harvey, Irma, and Maria and California wildfires in 2017.

What did FEMA release that it wasn't supposed to?

The breach - which is from the Department of Homeland Security -- includes not only personally identifiable information (PII) but also sensitive PII (SPII) which includes financial account info ... 20 unnecessary data fields.

Look, this is not new law: the Privacy Act was first implemented in 1974 (subsequent amendments).

What's new is the level of incompetence demonstrated by the Trump Administration.

Office of the Inspector General:

FEMA released this information "in direct violation of Federal and DHS requirements and its August 2015 TSA program Performance Work Statement."

OIG:
"FEMA did not take steps to ensure it provided only required data elements to [redacted]. Without corrective action, the disaster survivors involved in the privacy incident are at increased risk of identity theft and fraud."

FEMA pleaded guilty.
(Technically, they "concurred")

I do not consider 15 months an "expedited" response.

The report is dated March 15.

It was made public today, sure to be buried under #mueller news.

#privacy

H/T @TonyRomm

https://twitter.com/TonyRomm/status/1109212826021908481

When are we going to have sufficiently punitive fines on organizations (including government) and laws that make the person IN CHARGE the designated jailee so that data breaches like this one become a distant memory?

When?

#privacy #fema #dhs #trump

Unrolled >
threadreaderapp.com/thread/1109250…

Here’s the @washingtonpost
washingtonpost.com/national/healt…