Compliance with Common Sense

I was in line to board a plane yesterday, and what I saw got me thinking again. The passenger in front of me had a tag on his carry-on with his full name, address, and phone number, plus a secondary contact with another name and phone number. I understand the intention, but this information can do more harm than good. So I did a quick fact check for fun. The probability of an airline mishandling your luggage is about 0.5%, while the probability of becoming a victim of identity theft in a given year is close to 9%.

The answer is in the numbers, but who cares about compliance common sense?

It reminded me of the time my cousin flew to Dubai for the first time, two years ago. He was thrilled. Before the plane even pushed back, his boarding pass was on Instagram. Barcode, name, seat, flight number, everything.

I liked the post. Then the reflex kicked in. After more than 10 years in compliance, I always see an audit finding.

What a boarding pass actually says

That barcode isn’t decoration. Brian Krebs showed back in 2015 that it carries your name and booking reference, and sometimes your frequent flyer number. The booking reference is the key to the house.

Ask Tony Abbott. In 2020 the former Australian prime minister posted his boarding pass on Instagram. A researcher named Alex Hope used the booking reference to log in to Abbott’s Qantas booking and pull out his passport number and phone number. No hacking tools. Just a photo and a login page.

To be fair, PCI DSS (Payment Card Industry Data Security Standard) and HIPAA (Health Insurance Portability and Accountability Act) don’t apply to you. Nobody audits your Instagram. But those rules exist because the risk is real, and the risk doesn’t care how the data gets exposed.

We fine companies for this

In 2023 the EU fined Meta €1.2 billion for sending Europeans’ personal data to the US without adequate protection. When a company leaks a customer’s name and birth date, we call it a breach and want someone fired.

Then we post the same data ourselves, for likes.

After that incident, I started auditing my family’s feeds with TLC (Tender Loving Compliance).

The findings

Boarding pass on Instagram. Severity: High. Name plus booking reference, which is enough to open the booking. Control failed: protection of PII (personally identifiable information).

Baby announcement. Severity: High. After her baby was born, my sister-in-law thanked the hospital staff with a lovely post: the baby’s name, date and time of birth, weight, and photos of the hospital and the team. That’s a full identity record, published on the baby’s first day. Not an ideal way to start life.

Name or birth year on the car tag. Severity: Medium. Your name, on a car tag, parked in a known driveway. Anyone curious can link that to public records in an afternoon.

“Finally got my new card!” Severity: Critical. Card number and expiry, and sometimes the CVV on the back. In PCI terms, that’s the cardholder data companies spend millions encrypting. This photo hands it out for free. And the same information gets shared freely among family members on WhatsApp, or sits in their photo albums.

“Get to know me” quizzes. Severity: High. First pet, the street you grew up on, your mother’s maiden name, your first car. Those aren’t fun facts. They’re your bank’s security questions. The Better Business Bureau has warned about these quizzes for years.

Real-time vacation posts and home address on luggage tags. Severity: Medium. One tells the world your house is empty. The other tells everyone at the airport where it is.

Labels and pill bottles in the recycling. Severity: Medium. Shipping labels show your name and address. Prescription bottles show what you take. In a company, this is a data disposal failure, and it can result in severe fines. At home, it’s Tuesday’s recycling bin.

Management response

Every audit ends with management’s response. Here’s what I hear at family dinners, and I know these would annoy anyone in compliance.

“I have nothing to hide.” You’re not hiding anything. You’re protecting it. Your front door has a lock, and nobody accuses you of hiding your favorite couch.

“Who would want my data?” Nobody wants you specifically. Attackers want volume, and your data is one easy row in a very big spreadsheet.

What to actually do now

You don’t need a compliance program. You need a free Saturday morning.

• Post travel photos after you land, and keep the boarding pass out of frame.
• Share baby news without the birth time and hospital. Grandma doesn’t need the timestamp.
• Never photograph the front or back of a card. If it’s already online, delete it and ask the bank for a new number.
• Give security questions answers that aren’t true. Your first pet can be “purple tractor.” Keep it in a password manager.
• Take your name off the plate, and put a phone number or email on the luggage tag instead of your home address.
• Peel or shred labels before the box goes out.

None of this makes sharing a mistake. Share the trip and the baby. Just leave the barcode out.

My cousin had a great time in Dubai, by the way. I know because I saw his seat number in business class.