State decides to not fine Sylvan Learning Center after files found in dumpster

Update, Oct. 7, 2013: The Oregon Department of Consumer and Business Services investigated this case and determined only one of the files included any information considered "confidential" under the Oregon Consumer Theft Protection Act. The state determined it was an isolated incident and that it is not Sylvan Learning Center's practice to discard client information without first shredding it.

As a result, there was no fine imposed on Sylvan. The state did ask Sylvan owner Tom Van Houten to submit a written data security plan to make sure his employees fully understand their responsibilities under the Consumer Theft Protection Act.

Original story:

BEAVERTON, Ore. - It was identity theft waiting to happen.

Beaverton police said employees at the Sylvan Learning Center threw away a large amount of business documents containing personal information about clients. Workers at a nearby business called police to report the files on Friday.

Sylvan Learning Center branch owner Tom VanHouten says they don't keep that kind of information at the branch, and anything sensitive is shredded before it's thrown away.

"They should have been, and were intended to have been shredded," said VanHouten. "But I wasn't here, and when the files were purged, they were put into a recycling box and out the door they went."

Detective Sgt. Jim Shumway said the documents may contain information about hundreds of people. They contained full names, dates of birth, Social Security numbers and copies of credit cards.

"It's shocking," Shumway said. "It's surprising that in 2013 there are people out there who seemingly don't know that that's what all these new shredding companies exist for, is to properly dispose of people's personal information so that identity thieves don't get in it."

Police say the files likely date back five years and more.

Police put the files into seven large boxes. Shumway said it didn't appear they had been in the dumpster for very long before they were found.

"We've spoken with the company. They did tell us that they directed the employees to dump those files into the dumpster."

The files were turned over to the Oregon Department of Consumer and Business Services for investigation, Shumway said.

DCBS spokeswoman Cheryl Martinis said the department could potentially issue penalties of up to $1,000 per violation. In this case, each client's record with their personal information could be a single violation, she said.

The department has not yet received the boxes.

"A lot of businesses may not be aware that they're supposed to have a plan for disposing of information," she said. That's required under the Oregon Identity Theft Protection Act passed by the State Legislature in 2007.

Sylvan Learning is a tutoring company. Police are encouraging anyone who has even submitted personal information to the Beaverton center at 12225 SW 2nd St. to check their accounts and credit ratings to make sure they are not a victim of identity theft.

Sylvan Learning has "helped over two million students learn to read, write, calculate and organize themselves," according to its website.

Fines against companies that mishandle information are rare but can be substantial.

Oregon's Department of Consumer and Business Services in 2009 fined Brooke Insurance $11,000 for throwing customers' personal information in a dumpster. $8,500 of that fine was suspended after Brooke set up a system to prevent that from happening again.

KATU's Bob Heye contributed to this story.