720-913-5000 auditor@denvergov.org

City agencies collect what’s known as “personally identifiable information” from residents for reasons related to programs and services.  “PII”, as it’s known in shorthand, includes information like full legal name, maiden name, Social Security number or driver’s license number.  Auditor Timothy M. O’Brien, CPA, recognized the need to collect such data, but recommended a strategic framework and policies to protect against unauthorized access to this sensitive information.

“Unfortunately, we live in an age where identity theft is a real threat.  Those who are required to submit personally identifiable information should be confident that it will never fall into the wrong hands,” explained Auditor O’Brien.  “This includes employees as well as members of the public.”

The audit team found large amounts of PII that should be secured and was not, outdated policies, and inconsistent practices, all presenting a risk of unintended PII disclosure.  Whether personal information is collected via the internet or in person, the storage, retention, and disposal of such information varies by agency. Paper forms, while increasingly rare, must be stored in locked premises.

Denver’s Technology Services department has convened an Information Governance Committee to address PII policies, including how access to shared information is managed.  Because of the varying needs of each agency, Tech Services intends to remediate procedures one-by-one.  In addition, Tech Services has created a security awareness training tool for all employees.

“The Information Governance Committee will also address issues like retention schedule, disposal methods, and encryption procedures for the City,” said Audit Supervisor Shannon Kuhn.  “Best practices, as well as methods of thievery, are evolving all the time.  It makes sense for Technology Services to have an ongoing way to protect sensitive information.”

“Victims of identity theft spend money and time unwinding the damage,” observed Auditor O’Brien.  “Our goal is to prevent that from happening.”

Read the report.

Colorado Statesman December 16, 2016

%d bloggers like this: