State and Federal Laws mandate that employers take the necessary steps to protect the non-public information (NPI) they collect.  The laws further require employers to monitor the compliance efforts of their service providers who have access to their data, premises and vehicles transporting data to ensure they are also taking reasonable measures to protect the employers NPI.

Employees and service providers are the weakest links in protecting and securing your data.  Data breaches cost companies an average of $5 million per incident in direct costs according to a recent study by the Ponemon Institute. Business reputations are on the line when faced with a data breach and victims often cut ties with the companies that compromised their private information.
 

Employees may  bring class-action suits against employers for actual and punitive damages. In addition, federal fines of up to $2,500 per employee, and state fines of up to $1,000 per employee also may be levied due to a new provision of the Fair and Accurate Credit Transactions Act (FACTA) which recently took effect. It states that any employer whose action or inaction results in the loss of employee information can be fined by federal and state government, and sued in civil court.

Attorneys are trolling the internet advertising for victims of identity theft.  Hundreds of cases are underway against employers whom they believe have been negligent in safeguarding customers and/or employees private data.  Their ads include language i.e.;  “Free identity theft assistance, experienced lawyers on your side, free identity theft case review, click here…..The law professionals of our firms are on your side if your rights have been violated, we will fight to recover what your are entitled to”.  An identity theft lawsuit is very expensive and almost impossi

One solution that provides an affirmative defense against potential fines, fees, and lawsuits relating to identity theft in the workplace is to offer some sort of identity theft protection as an employee benefit. An employer can choose whether or not to pay for this benefit. The key is to make the protection available, and have a mandatory employee meeting on identity theft and the protection you are making available, similar to what most employers do for health insurance.