PRIVACY CONCERNS SPUR POLICY CHANGE BY DION NISSENBAUM Mercury News Sacramento Bureau SACRAMENTO -- One of the nation's largest online genealogy companies decided Thursday to remove from its Web site personal information about people born in California -- but only for people who ask. The company, RootsWeb. com, took the action after it was thrown into the spotlight Wednesday by California lawmakers who demonstrated how easy it is to use the Web site to glean critical information, such as date of birth and mother's maiden name, that can serve as building blocks for identity theft. The move, announced late in the day, may satisfy some of the many Californians who called the company Thursday to complain about the availability of the personal information. But it is unlikely to quell the broader concerns because experience suggests that only a relatively small number of people will take the initiative to request that RootsWeb.com delete their data. And even if the company removed all 24 million California birth records posted on its site, that would not address the fundamental problem still facing lawmakers: Selling the information was -- and is -- legal. The state of California sells both birth and death records of millions of residents and makes them available on CD-ROM for as much as $900. Along with the birth records, RootsWeb.com also contains a database that lists more than 9 million death records in California. Many of the listings include a Social Security number, the most prized piece of information for identity thieves. ``Clearly this is a situation where all the residents of California have now been exposed to a new risk of identity theft,'' said Chris Hoofnagle, legal counsel for the Electronic Privacy Information Center in Washington, D.C. ``This should raise alarms.'' After reading about RootsWeb.com in the Mercury News, concerned Californians contacted the company and asked to have their personal information taken offline. Initially, some were rebuffed and told the data was public information. But after an executive meeting Thursday, company officials decided to remove the names of any Californians who ask. ``The mission of our company is to create places to help people reconnect with their families,'' said Craig Sherman, the chief marketing and revenue officer of MyFamily.com Inc., the parent company of RootsWeb.com. ``We're not in any way doing anything except helping our customers and if a customer is concerned about it, it doesn't do any good to leave them up on the site.'' Sharon O'Mara Hartman, who works for a Bay Area branding firm, was among those who asked the company to remove her name. ``Anything that has personal information on it is infringing on my privacy,'' she said. ``Coming across something like this was disturbing.'' MyFamily.com is one of the largest and oldest genealogy sites on the Internet and gets more than 5 million visitors a month. One other state, Texas, has provided similar information to RootsWeb. Privacy and identity theft have new meaning in the wake of the Sept. 11 attacks. All 19 men suspected of taking part in the deadly hijackings had Social Security numbers and only five were obtained legally. Some got fake IDs in Florida and Virginia. Earlier this month, Congress renewed a debate about the federal government's sale of a massive database of deaths in America. The information includes names, addresses, dates of birth, dates of death and Social Security numbers. California has made birth and death records available on CD-ROM for about two years. It is one of the few states in the nation to make birth certificates available to anyone who asks. Now, state lawmakers are taking another look at whether to place tighter constraints on release of such information. State Sen. Jackie Speier, D-San Mateo, said she plans to introduce legislation in the coming months to restrict access to state birth records. But some are concerned that the state may be moving to fix a problem that doesn't really exist. Terry Francke, general counsel of the California First Amendment Coalition, said people should be wary of too many restrictions on public information unless there is strong evidence that the Web site has been used in a crime. ``If we're going to start stripping not only the Internet, but public records, of information that others have found useful for generations on the basis that it might make some mischief or crime easier, then we're going to have a very different society before we realize it,'' he said. ---------------------------------------------------------------------------- ---- Contact Dion Nissenbaum at dnissenbaum@sjmercury.com or (916) 441-4603. Kim http://www.arbuckleonline.com/users/2buckets