If you had to guess, how many companies would you say have enough of your personal data stored in various databases to make even a rookie crook ready for prime-time conning?
You probably don't know the answer, and that is the problem.
In the last six months, the personal data of millions of consumers have been lost, stolen, or sold to thieves. The most recent case involved a financial unit of Citigroup Inc. CitiFinancial, which provides a wide variety of consumer loan products, said that personal information (Social Security numbers, loan account data, and addresses) of 3.9 million customers was lost by UPS in transit to a credit bureau. So far, CitiFinancial said it has no reason to believe the information has been used inappropriately.
Every time we hear of one of these cases, the companies involved tell their customers not to worry. Trust us, they say. They pledge to enhance their security procedures.
It's time for the federal government and the states to step in and make sure the companies fulfill those promises.
There have been some efforts to protect people's financial information. On June 1, a new federal rule took effect that requires businesses and individuals to destroy sensitive information derived from consumer credit reports.
There's just one problem with this ''Disposal Rule." There is no standard for how the documents have to be destroyed. ''The burden is completely on the consumer to protect what is important," said Evan Hendricks, editor and publisher of Privacy Times newsletter.
Oh, well, maybe we can turn to Congress for help in protecting our data. Several legislators have proposed or are working on bills to protect personal information. For example, Senator Dianne Feinstein, a California Democrat, has introduced legislation that would require companies to notify their customers in writing or by e-mail if they could be victims of identity theft because their data were compromised.
Senator Charles Schumer, Democrat of New York, and Senator Bill Nelson, a Florida Democrat, have cosponsored legislation that would limit the sale or transfer of sensitive personal information. It would also restrict the use of Social Security numbers.
I certainly applaud all these efforts. But they are just that -- efforts. Until Congress passes tough laws outlawing the collection of our Social Security numbers, at the very least, I plan on being as obnoxious as I can about protecting my data.
For instance, I recently contracted to have an alarm system installed in my home. As I was filling out the sales agreement, I noticed a request for my Social Security number. I refused to divulge it. The salesman said it was a requirement. He said I ''had" to give it to him.
I unequivocally refused to divulge my number. A manager of the company called. He explained that it was needed to pull my credit score because we were signing up for a three-year monitoring service. He said it had been their experience that people with low credit scores often break the three-year contract.
Even if that was the case, I was appalled at the lack of security about my data from this company. By my rough estimate, from the time the salesman took my service agreement to his office, my data could have been exposed to at least half a dozen of the company's employees. In several of the recent data breaches, employees were doing the pilfering.
I was prepared to leave my home unprotected for the time being in the name of protecting my personal data.
Ah, but here's where it pays to be persistent about protecting your data.
The manager came up with a way to get my Social Security number without me actually giving it to him or anyone else at the company. In a three-way conference call, he phoned the credit bureau and when the automatic system asked for the customer's Social Security number, I punched it in. All he heard on his end was a beeping sound. In a few seconds he got my credit score without having to know my Social Security number.
So folks, it's up to us. We have to become our own data protectors. You may not win the battle all the time, but if you're fierce enough you can reduce the number of companies that have your information.
Michelle Singletary is a columnist for The Washington Post.