So let’s say you find out someone stole your purse or broke into your office or your locker. Now they have your name, address, Social Security number, birthday, health insurance card and bank account number.

What would you do?

Would you call the police that morning to report the theft? Would you call your bank that afternoon and have your account number changed? Would you call one of the big credit bureaus the next day and arrange to have your credit report monitored?

Or would you just go on about your business for a month to give the thief plenty of time to siphon money out of your savings and set up a fake credit card account using your identity?

If you were one of 79,000 American Airlines retirees, you had no choice. That’s because the company chose to wait a full month before informing its former employees that someone had made off with a hard drive containing all their personal data.

Pity the poor communications director for American Airlines parent AMR Corp., who had to tell the Fort Worth Star-Telegram (and numerous other media outlets) that her company waited more than four weeks to acknowledge the theft because it “needed time to understand the scope of the data” and to arrange one year of free credit monitoring for former employees.

However, credulity stretches and breaks at the thought that it would take any more than two days to figure out what data one’s IT department is keeping on company hard drives.

At that point you could probably expect company executives to meet with their lawyers for another day to figure out how best to shelter themselves from the potential legal liability they stepped into.

But to mitigate that liability, and their corporate reputation, crisis PR management dictates that the company should have notified their former employees within perhaps four days of the data theft – not four weeks.

We suspect that AMR’s own communications professionals said as much to top management.

Unfortunately for everyone but the thieves, no one was listening very hard.