Some things never change. Until someone is held accountable, security is just another thing for executives to ignore and avoid. I wonder if that institution offers an identity theft prevention service to it's customers (for a fee of course). They may need it.

The bottom line is that you cannot trust any entity to protect your private information. PERIOD. As a result to fight identity theft and the ultimate trashing of your credit, etc you need to start at the end of the chain and freeze your credit files. At least in this way, when all of your information is stolen at least your credit is fairly safe. This of course does not prevent someone from creating a criminal record under your name after making a false ID.

This is where internal information security officers and IT auditors need to step in and follow the trash and the equipment to ensure that their companies are safeguarding your information.

Check with your local banks, government agencies, etc. See if they have IT auditors or IT security personnel etc on site. Many entities and governments treat this kind of staff as uneccesary when in the end they are your last hope when Joe Blow IT staff worker or banker chucks your life in the street.