Disney workers sue over identity-theft risk....

[WDWmazprty]

Check it out:

http://ocresort.ocregister.com/2011/02/22/disney-workers-sue-over-identity-theft-risk/70903/


Disney workers sue over identity-theft risk

February 22nd, 2011, 1:09 pm · 28 Comments · posted by Sarah Tully



Share94



Disney employees filed a class-action lawsuit against the company claiming that employee identification cards expose them to identity-theft risk. (Story updated at 2:20 p.m.)
The suit was filed Tuesday morning in U.S. District Court in Los Angeles.
Suzi Brown, a Disneyland Resort spokeswoman, said Disney is working to improve the safety of employee ID cards.
“We disagree with the legal premise of the lawsuit,” Brown said. “Protecting cast members’ (employees) personal information is a responsibility we take very seriously. ”
The Walt Disney Co. issues ID cards that are encoded with Social Security numbers, which violates California law, according to the lawsuit.
The codes can be read by most cellular phones, including the Apple iPhone and Android devices, according to employees. Many smartphones have apps that can be used to take pictures or scan bar codes to get the information behind them, such as prices on store items. That information also can be sent to others via e-mail messages. One Disney employee discovered by accident that Social Security numbers could be revealed when he was playing with his smartphone.
“The way they have handled this situation, we just can’t understand it,” said Jorge Iniestra, a lead plaintiff and bellman at the Disneyland Hotel. “It’s obvious they don’t see it as a serious issue.”
The suit’s backers hope to include all 21,000 employees at the Disneyland Resort, Orange County’s largest, private employer. But the lawsuit could extend to thousands more of Disney employees in California, according to the employees.
Disney employees have been complaining about the issue for about two to three years.
Employees, attorneys and representatives announced the lawsuit at a press conference Tuesday in front of the Grand Californian Hotel in Anaheim. Representatives from two unions attended the event.
Roman Delgado, the business agent for Teamsters Local 495 that represents 3,500 Disney employees who was not at the conference, said he’s heard of no problems related to the identity cards.
Disney officials and employees said they are unaware of any identity-theft problems that have been tied directly to the ID cards. But Eddie Chavez, a Disneyland Hotel bellman, said he knows of at least four or five employees who recently experienced identity theft.
Brown said Disney already has informed employees how to protect their cards and changed practices to improve safety. For examples, employees are no longer required to hand over their ID cards to get discounts at restaurants.
“Work is well underway to modify our computer systems to address ever changing technologies, such as third-party smartphone apps,” Brown said.
Two identity-theft experts had different opinions about the lawsuit: Both said they think Disney should discontinue the practice.
Jay Foley, executive director of the San Diego-based Identity Theft Resource Center, said the law clearly states that employers can’t print Social Security numbers on ID cards, but he was unsure about encoded numbers.
“That’s probably something that a judge is going to have to decide,” Foley said. “I would personally say I would not do that to my employees. It exposes them to risk that they don’t need to be exposed to.”
Mari Frank, a Laguna Niguel attorney who is a certified privacy expert, said she believes Disney is breaking the law with the bar codes.
“I’m pretty much shocked how they are doing this,” Frank said. “The Social Security number is key to the kingdom of identity theft.” Read a previous story about Mari Frank of Laguna Niguel.
The Disney hotel union, Unite Here Local 11, organized the press conference. The union has been embroiled in a contract dispute with Disney for more than three years.
“The fact that Local 11 leadership is trying to sensationalize this situation, like many others over the past three years, underscores that they seem to have no genuine interest in resolving their labor dispute,” Brown said.
The Disneyland Resort in Anaheim includes two theme parks, three hotels and the Downtown Disney shopping-entertainment district.

 

[cmwade77]

Ok, while I think they have been greedy at the negotiating table, I do feel that they are correct on this one. If the codes do contain social security information, then they need to be changed and an have an official apology issued. It is far too easy to scan a QR code now and get detailed information from it. This is indeed a security risk, especially when many CMs are required to keep these visible at all times.

I also think Disney should have to pay something to everyone that works for them, such as 5 years worth of LifeLock. In addition if anyone did have thier identity stollen as a result of this Disney should have to pay for ALL costs associated with fixing it.

This is printing the social security number on the i.d. QR codes are not encrypted, they just can't easily be read with the naked eye.

And I am not a CM, I do have an annual pass though and I find this practice disturbing to say the least.

 

[Wilt Dasney]

Brown said Disney already has informed employees how to protect their cards and changed practices to improve safety. For examples, employees are no longer required to hand over their ID cards to get discounts at restaurants.

I personally witnessed this last month at WDW. I was having dinner at the Contemporary with a CM. When it came time to apply her discount to the meal, the waiter was clear that he couldn't take her card and just wrote down the basic information from it. When she asked why, he said it had something to do with cell phones.

 

[cmwade77]

That's cool and all, but the point is that they are violating the law just by printing it on there in any form.

For example: What if a CM lost their ID Card? Someone could get the info from the QR code quite easily.

All that should be on the ID Card is (printed and information on the magnetic stripe):
First and Last Name
A company assigned Employee ID Number
Department
and maybe Position worked

The rest of the information should be stored in a secured computer.

 

[TP2000]

That's cool and all, but the point is that they are violating the law just by printing it on there in any form.

This is media grandstanding by the Disneyland Hotel union, plain and simple.

The California law from 2005 states that it is illegal for an employer to do this;

"Print an individual’s SSN on any card required for the individual to access products or services provided by the person or entity."

The phrase "print" generally means to present plainly in typeface, such as 123-45-6789, not encoded in electronic form.

Further down the 2005 law also states it is illegal to:

"Encode or embed the SSN in or on a card or document, including, but not limited to, using a bar code, chip, magnetic strip, or other technology, in place of removing the SSN as an effort to comply with these new provisions."

http://www.ucop.edu/irc/services/documents/SSNLawSummary-update805.pdf

That would seem to back up the reading of the law that an encoded barcode is not the same as a "printed" barcode. And since Disneyland's employee ID cards have had barcodes on them since the early 1990's, it was not an "effort to comply with these new provisions" of 2005.

Even just five years ago when this law was passed iPhones and smartphones didn't exist that had the "app" technology to read bar codes. For decades bar codes were those mysterious things that only the checker at your supermarket could make any sense of.

While it's clear technology has changed and Disneyland should remove the encoded information from the barcodes on the 20 year old ID cards, I don't think this lawsuit will stand up well in court because of the timeframes involved and the wording of the 2005 law.

It gives the union something to bellow about though, instead of negotiating a new contract for their members.