Admitting Error Is the Better Part of Valor

Really, if an agency does something like accidentally leak the Social Security Numbers of several hundred employees, who decides it's best to wait a year to notify them? I understand that apologizing is embarrassing and painful. But it is always more painful if you wait. Because if you do, the "this agency leaked my data" story becomes the "this agency leaked my data and covered it up" story, or the "this agency leaked my data, covered it up, my identity was stolen and my life ruined" story. It is always, always worse to wait. And it's the right thing to do. The people you potentially hurt matter a lot more than your reputation, and it's better for your reputation if you take action on that principle.