Databases That Never Forgive Even When Required To

In most states, people arrested for or convicted of minor crimes can have their records expunged – a societal forgiveness that's increasingly important given we now live in a background check world.

But as the New York Times reports today, expungement means little given that data brokers buy and sell data without knowing for certain it is accurate.

In 41 states, people accused or convicted of crimes have the legal right to rewrite history. They can have their criminal records expunged, and in theory that means that all traces of their encounters with the justice system will disappear.[...]

But real expungement is becoming significantly harder to accomplish in the electronic age. Records once held only in paper form by law enforcement agencies, courts and corrections departments are now routinely digitized and sold in bulk to the private sector. Some commercial databases now contain more than 100 million criminal records. They are updated only fitfully, and expunged records now often turn up in criminal background checks ordered by employers and landlords.

The Times talked to one victim of this sloppiness, Victor Guevares, a thirty-three year old man who, some ten years prior, had been convicted of disorderly conduct, a charge equivalent to a parking ticket in NY state.

But Acxiom, a database company, reported the disorderly conduct charges to the Tyco Healthcare Group, which had offered Mr. Guevares a job in 2004. Tyco promptly withdrew the offer, one that would have doubled Mr. Guevares’s salary, to $46,000. It based its decision, his lawsuit says, on its mistaken understanding that he had committed a misdemeanor and had lied on his application about whether he had ever been “convicted of any crime which was not expunged or sealed by a court.”

There's no simple answer to this problem and its only going to get worse (check out Robert O'Harrow's No Place To Hide for more info).

More (including thoughts on how bad databases might violate the Universal Declaration of Human Rights) after the jump...

Read the rest.

One method is to either tether data to its source so that it updates in real time, but this mostly a solution for inter- or intra-departmental databases.

Requiring data brokers which sell information that is used to make decisions about you (not simple marketing data) to include attribution data and be liable for consequences is another possibility.

Jeff Jonas, a database and security specialist at IBM, has more on the need for attribution:

[A]ll information transfers should include source attribution (whether it is an anonymized information transfer or not). Otherwise, organizations cannot audit their systems and cannot ensure a “non-arbitrary” process or outcome … a fundamental human rights “no no”. This is because if an authority is operating on a “fact” for which they cannot establish its source … how could that not be provably non-arbitrary?

Jonas also wonders if bad databases violate the Universal Declaration of Human Rights.

Photo: Mell242, Hat Tip: AF