Suing a County Program That Disclosed Your Social Security Number

Attorney Answer

Probably not — at least not against the county program itself on a state-law claim. Pennsylvania's governmental immunity statute covers a county-run DUI program, and a six-month written-notice deadline may already be running against you.

42 Pa. Cons. Stat. § 8541 states the rule: except as otherwise provided, no local agency is liable for damages on account of any injury to a person or property caused by any act of the local agency or its employees. A county DUI program is a local agency for these purposes.

42 Pa. Cons. Stat. § 8542 lists the exceptions, and there are nine of them: vehicle liability; care, custody or control of personal property; real property; trees, traffic controls and street lighting; utility service facilities; streets; sidewalks; care, custody or control of animals; and sexual abuse. Sending your name and Social Security number from a personal email account is not on that list. That is likely fatal to a state-law negligence claim against the program.

And there is a deadline that can end the claim before the immunity question is ever reached. 42 Pa. Cons. Stat. § 5522(a) requires written notice of a claim against a government unit within six months of the date the injury was sustained and the cause of action accrued.

None of that means do nothing. It means the earlier answer's suggestion that you could "potentially sue for damages" pointed you at the least likely remedy while skipping the two things that actually protect you: the notice deadline, and the practical steps that stop an exposed Social Security number from becoming a stolen identity.

What you can do

1. Keep the letter, the envelope, and write down the date you received it. That date matters to the notice question. 2. Ask the program in writing this week for specifics: what was disclosed, to whom, on what date, how they learned of it, and what credit monitoring or identity protection they are providing. 3. Place a free credit freeze with all three credit bureaus and request an IRS Identity Protection PIN. These prevent the harm a lawsuit could only compensate. 4. Document any concrete harm — accounts opened in your name, a rejected tax return, denied credit. Actual harm changes the analysis; worry alone rarely supports damages. 5. See a lawyer well inside six months, so a notice under 42 Pa. Cons. Stat. § 5522(a) can be served if any claim is viable, and so they can assess whether anything other than a state-law tort theory fits these facts. 6. Do not sign a release in exchange for credit monitoring without having it read first.

⏱ Time limits apply. 42 Pa. Cons. Stat. § 5522(a) requires written notice of a claim against a government unit within six months of the date the injury was sustained and the cause of action accrued. When your six months began depends on your specific facts — including whether the clock runs from the disclosure itself or from when you learned of it, which is exactly the kind of question that should go to a lawyer rather than a calendar. Do not wait to see whether identity theft develops before getting that advice.