My company is a ticking time bomb. They store social security numbers in their database (their own employees, among others) without any encryption, and they have hundreds, if not thousands, of places on their website vulnerable to SQL injection attacks.

Of course, I will not be revealing what company it is or giving any more detail than I already have.

When/if I leave, will I be able to make some kind of legal demand that they erase my SSN from their database?

  • Probably not. Your SSN is required for many of their tax records, and the IRS usually recommends that a company retain employment and other HR records for past employees for upwards of 7 years. Likely you wouldn't be able to do anything until a data breach occurred, at which point you could sue them for damages due to their negligence. – animuson Oct 29 '16 at 17:23

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.