Out of Business, Clear May Sell Customer Data

narramissic writes "Earlier this week, the Clear airport security screening service ceased operations, leaving many to wonder what would become of the personal information, including credit card numbers, fingerprints, and iris scans, of Clear's customers. And now we know. The information could be sold to the provider of a similar service. Until then, Clear has erased PC hard drives at its airport screening kiosks and is wiping employee computers, but the information is retained on its central databases (managed by Lockheed Martin). Clear customer David Maynor, who is CTO with Errata Security in Atlanta, wants Clear to delete his information but that isn't happening, the company said in a note posted to its Web site Thursday. 'They had your social security information, credit information, where you lived, employment history, fingerprint information,' said Maynor. 'They should be the only ones who have access to that information.'"

Comments

The underlying issue

[houghi]

What is much more worrying is that personal data can be sold at all. OK, so here people have given their details voluntarily. Often that is not a reasonable option, except for doing everything in cash.

What should happen is that personal data can NEVER be sold.

Obviously that can cause problems. What if the company is sold as a whole? What if the company is ripped apart by its new owner and they sell everything, except the data?
I would think that if it is used to continue a service or contract I previously had, then you can use that. The moment you do not provide me any service, the personal data must be 'given back' or destroyed, so it is not longer usable by the company.

Desrtuction of the data should be done in, say, one year, so the company can still try to convince you to re-start the service.

This must be obviously regulated in some way, but the principal should be that the data belongs to the person, not to the company who stores that data. You can use that data for a specific reason and nothing else.

In other words, privacy laws must become much more pointed towards the people and away from the companies.