ChoicePoint lessons learned.

• Author: Swartz, Nikki
• Position: UP FRONT

After its involvement in a headline-grabbing 2005 data breach that compromised the records of 163,000 people, ChoicePoint has since turned itself into a role model for how to do data security and privacy right. So much so that the company, which provides data used in background checks, now is sharing its experience and advice on securing consumers' personal information.

It's a remarkable turnaround. After ChoicePoint handed over sensitive data about individuals in its database to criminals pretending to be clients, the company paid $10 million in civil penalties and $5 million to consumer victims. The company, which settled separately with 43 states over the breach, also decided to limit the sale of information products containing sensitive consumer data, such as Social Security and driver's license numbers, according to a NetworkWorld report.

As a result, ChoicePoint left what was a more than $15 million business serving small and medium accounts because it could not adequately confirm the credentials of those customers in a cost-efficient manner, Daniel Lemecha, ChoicePoint's chief information officer and senior vice president said, speaking at the 2007 IDC IT Forum & Expo in Boston. Over the past 24 months, he said, ChoicePoint has gone through more than 80 external audits.

In April, a Gartner analyst told USA Today that ChoicePoint has "transformed itself from a poster child of data breaches to a role model for data security and privacy practices."

At the IDC IT Forum, according to Network World, Lemecha offered a five-step plan based on ChoicePoint's actions for securing data and privacy systems:

1. Governance: ChoicePoint's chief privacy officer reports directly to a board that governs privacy and public responsibility, bypassing the rest of the corporate structure, according to Lemecha. The board is briefed quarterly on progress improving privacy and security, and several other committees are responsible for more specific oversight roles. The company also has several divisions that handle privacy and security from different angles, such as a corporate credentialing...