Post By: Adam Turteltaub

Who are you?

It’s a question a wide range of organizations need to ask about everyone from their own employees to their customers.  To understand the risks we sat down in this podcast with Susan Dworak, CEO of Real Identities and author of the chapter “Compliance and Fake IDS: Complications of Checking ID and Confirming Identity” in the new SCCE Complete Compliance and Ethics Manual 2021.

The list of organizations needing to check identities is longer than many may think. It includes the obvious ones, such as those involved in the sale of alcohol, tobacco, cannabis and firearms. But it also includes banking, notaries, government clerks, hospitality, medical, dental, and even schools.

Training staff is difficult because of the complexities involved. There are over 800 versions of driver’s licenses in the US, each of which may have 20-100 security features, she explain.

In the face of this, some may opt to pursue the purchase of an identity scanner, but that can be an expensive proposition.

So what do you do? First, there’s a need to realize that if you’re collecting identification data that you need to protect this sensitive, personally-identifiable information. Determine what you are collecting, why you are collecting and storing it, and how you are doing so. And, if that data is of European citizens, you also need to recognize that GDPR likely applies.

Talk to legal and your IT team to understand how that data is handled, including whether your organization is relying on third parties. If the data is being handled elsewhere, take the time to read the disclaimers of the vendors to understand the limits of their technology and how they will protect your organization in case of a failure.

Finally, she advises to look inside your organization to see what kind of hardware you are using. An old router or unsecured device can provide a gateway to all this sensitive data.

Listen in to learn more, and, to learn even more, be sure to get new SCCE Complete Compliance and Ethics Manual 2021