In case you missed it a few days ago it was revealed that the Starwood Preferred Guest (now owned by Marriott) reservation system was breached and data of 500 million customers was stolen. One of the pieces of information that was stolen includes passport numbers. Senator Charles Schumer came out and advocated that Marriott should pay for the costs of replacing passports for those that are impacted. Since then Marriott has announced that they will pay for the cost of replacing a passport, but only if it can be proven that fraud has taken place.
Because of this breach the State department has had to issue advice to consumers recommending that they don’t request a replacement if they were involved in this hack. Despite that assurance, one of the questions asked when reporting a lost/stolen passport is the previous passport number, NY Times has dedicated a piece to whether you should ask for a replacement. I’m of the belief that companies that suffer data breaches should be responsible for any reasonable costs involved in both protecting and restoring your identity if stolen. In this case Marriott is only happy to pay for passport replacements after fraud has occurred and even then you need to go through their process and they still will only pay out if that process determines fraud has occurred.
At the moment the costs of data breaches are being absorbed by companies other than those suffering the breach. For example, on the other side of every fraudulent transaction somebody is left paying that bill (e.g if credit card fraud occurs then either the payment network, card issuer or retailer accepting the payment are liable). Having your identity stolen can be life ruining and at this stage it’s clear that large scale corporations such as Marriott & Equifax are not taking information security seriously and refuse to invest resources in keeping personal data safe.
