[Full-Disclosure] Emailing SSN info

Hi all,

I work for a school district in the USA. Higher management wants to
email a zipped data export (presumbably password protected) to a vendor
that includes the Social Security Number for employees. I have advised
them against this. Shipping a CDROM overnight would be more secure, IMO.

Now they want to know if there are any laws pertaining to the emailing
of SSN info. (Why they are asking me and not an attorney, I am not
sure...though I AM going to tell them to speak to an attorney too.)

Can any one point me to a website or cite specific US (or even state)
laws regarding this? Even a reply telling me why this is a bad idea
would be great. If I am wrong, I am glad to hear that too. Thanks in
advance!

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.netsys.com/full-disclosure-charter.html
Received on Thu Mar 18 17:05:47 2004