Employees may bring class-action suits against employers

Employees may  bring class-action suits against employers for actual and punitive damages. In addition, federal fines of up to $2,500 per employee, and state fines of up to $1,000 per employee also may be levied due to a new provision of the Fair and Accurate Credit Transactions Act (FACTA) which recently took effect. It states that any employer whose action or inaction results in the loss of employee information can be fined by federal and state government, and sued in civil court. An employee is entitled to recover actual damages sustained if their identity is stolen due to the employer's inaction, or statutory damages up to $1,000.
 
A recent case in Michigan highlights one source of corporate liability. In the case of Audrey Bell et al vs. AFSME AFL-CIO Local 1023, the Michigan Appeals Court affirmed a jury award of $275,000 to AFSME members who had sued the union for failing to safeguard its members Social Security numbers. It recognized a special relationship between the union and its employees, including a duty to protect them from identity theft by providing safeguards to ensure the security of their most essential confidential identifying information, information which easily could be used to appropriate a person's identity. 
 
"When the charges started rolling in, for almost two years, these people had to spend hours of their days, every day, dealing with angry creditors," Parker said. "One person had to postpone her retirement because her credit had been trashed. Another couldn't get credit at a time when she needed it badly. Another had to deal with an angry wife who looked at the charges and was convinced that he'd set up housekeeping with a honey." The jury award compensated them for the mental anguish of trying to straighten out their credit histories.The Bell case has national implications for employers. Arizona, California, Illinois, Texas, and other states have statutes that require an employer to restrict the use and disclosure of Social Security numbers. While not as broad as Michigan's law, they support the view that a "special relationship" exists between an employer and an employee whose data is stolen from the employer to commit identity theft.Even in jurisdictions with no statutes restricting employers' use or disclosure of employee Social Security numbers, the tide of legislation on identity theft may be sufficient to support a finding of the necessary special relationship. The Wall Street Journal recently predicted that there will be a flood of lawsuits by both consumers and businesses because of identity theft issues.
 
Employers also suffer other significant costs when their employees experience identity theft. Conservative calculations based on current identity theft figures indicate that an employer with 1000 employees, who make an average of $40,000 salary per year, should expect to incur productivity losses of more than $600,000 per year. Identity theft also threatens enterprise security, enabling corporate espionage and fraud, and theft of hard assets and intellectual property. Large scale or frequent identity thefts also results in significant negative publicity, impacting sales, partnerships, and employee recruiting and retention.