Well, if you live in California, that's exactly what's been happening. If you don't, don't assume you're in the clear — plenty of other states are doing the same thing.

In 2004, a website run by the California Secretary of State's office began selling public documents containing names, addresses, Social Security numbers, and in some cases even the signatures of people who had applied for secured loans — in other words, people who put up collateral as part of their loan application process. Tens of thousands of Californians are in that category.

That finally came to an end just last week when California Assembly member Dave Jones blew the whistle on the practice and demanded it stop. "For the past three years, the state has been in the data broker business," said Jones. "This is a gold mine for identity thieves."

Soren Tjernell, senior legislative assistant to Assemblyman Jones, had been hunting down breaches of personal information by public officials. Tjernell got a tip that the Secretary of State's website might be a good place to start, so he paid his six bucks and gave it a try. The first document he downloaded contained the names, addresses, SSNs, and signatures of two individuals — a real bargain at three dollars an identity. "It was wickedly easy," Tjernell told me.

The documents in question (known as Uniform Commercial Code, or UCC forms) are checked by lenders and title insurance companies to make sure secured loan applicants aren't using the same collateral for more than one loan. "The SSN is a way to distinguish among all the Dan Smiths out there," notes Tjernell. For their purposes, however, the last four digits of the SSN work just as well.

Jones has introduced California Assembly Bill 1168, which would let the Secretary of State's office reject documents submitted with SSNs and require local governments to black out the first five digits of SSNs on records released to the public. In the meantime, at Jones' prompting, California Secretary of State Debra Bowen has blocked online access to the UCC documents and will redact all but the last four digits of any SSNs before releasing them.

"We wanted to strike a balance between legitimate use of public records and personal privacy," says Tjernell. "We're not trying to block information on government decisions, or even personal transactions. But the right to privacy is in the Constitution."

All this matters to you for a couple of reasons. Obviously, if you've applied for a secured loan in California, it's one more reason to be vigilant against identity theft and fraud. That means checking your credit report regularly for signs of abuse, monitoring bank and billing statements closely for charges you can't explain, and protecting yourself against mail theft, mail redirection, and other favorite moves in the identity thief's playbook. Unfortunately, you have no way to know whose hands your data might be in or what they might do with it. That makes caution the only reasonable course.

This is also one more sign of how utterly broken the system is. The fact that we still use Social Security numbers as an identifier is appalling. Using knowledge of your SSN (or any portion of it) as authentication — that is, to give you access to things like bank, phone, and credit card accounts — is just plain stupid.

Which brings us to those last four digits. As long as Verizon, T-Mobile, and thousands of other companies accept them as proof of identity — and they do — revealing them to the public punches a hole in the wall protecting your accounts from abuse. They may not be enough to open a new line of credit in your name, but they can still compromise your accounts and enable identity thieves to build on the sensitive information they already have. Businesses that rely on them need another system, even if it's less convenient — one that doesn't expose their customers to the risk of identity theft.

Tjernell acknowledges that Jones' bill doesn't address the whole problem. "We have wrestled with this issue. Obviously we need to stop using those last four digits as an identifier. We haven't figured that part out yet." Meanwhile, if AB 1168 makes it harder for criminals to plop down six bucks and open a new line of credit in someone else's name, it'll be a big step in the right direction.

Have you applied for a secured loan in California? Does your state have your identity data up for grabs? Who should take responsibility when a data breach leads to a stolen identity? We'd like to hear from you in our comments below.