PRIVACY ISSUES: New Wrinkles
IVAN HOFFMAN, B.A., J.D.
One of the “instances” I mentioned above deals with sites that cater to and gather information from children. These sites are regulated under the Children’s Online Privacy Protection Act (COPPA). The act is very complex in its application and all sites that even remotely fall within its orbit should consult an experienced attorney about how to comply. Read “The Children’s Online Privacy Protection Act” and “Verifiable Parental Consent Under COPPA” for much more detail about this legislation.
Toysmart.com entered into a Consent Decree with the FTC in which it was agreed among other provisions that:
1. the database of names etc. could not be sold as an asset standing alone but only as an integral part of the business assets as a whole;There were some procedural issues related to this matter which are outside the scope of this article.
2. the only third parties who could purchase the entirety of the site would be a “Qualified Buyer.” A “Qualified Buyer” was defined as “an entity that …concentrates its business in the family commerce market, involving the areas of education, toys, learning, home and/or instruction, including commerce, content, product and services” and which agreed to be a “successor in interest” for that database. This latter term meant that the buyer had to agree to abide by Toysmart’s original privacy statement that it offered to visitors (that such information would not be shared) and that if the buyer desired to change that policy, that it first notify all such persons who provided that data and obtain the express, affirmative consent to the new uses…so called “opt-in” marketing; and
3. in the event that such a Qualified Buyer did not come along within a year or unless there was a court-approved reorganization, the entire database must be destroyed and that, irrespective of the other data in the database, all the information collected in violation of COPPA had to be immediately destroyed.
Voter.com, as part of its winding down of its business, set up an auction for several of the assets of the company including the “Voter.com Newsletter subscriber and registrant list.” That list contained approximately 170,000 individual email address, descriptions of issues of interest as well as, in many instances, zip codes, sex and political party affiliations. Individual names and addresses were not part of the database.
“Merger, Acquisition of or by Voter.com In the event of a merger or acquisition of or by Voter.com, your personally identifiable information in Voter.com’s records will not be used for any purpose other than to provide personalized political news and information without your explicit permission.”Additionally, Voter.com had a license agreement with TRUSTe and as part of any such sale, Voter.com agreed to send an email to all of the email addresses on its list after a purchaser was identified but before the sale was completed and the list turned over. Specifically, the statements were:
“That email will detail the “personalized political news and information” which the purchaser will provide to the former Voter.com subscribers/newsletter recipients and will provide them with an easy way to “opt-out” of the list and two weeks to decide. Those who choose to “opt-out” will not be included in the list provided to the purchaser of [the database] after the two week notice period has expired.”Any deal with a purchaser would have to include representations that the bidder is or will be in the business of providing the above kind of information and will use the database solely for that purpose “(although advertising messages and electronic direct marketing may be sent by the purchaser of the list to subscribers on behalf of other entities as long as those entities do not receive access to the individual email addresses).”
As we all struggle to define who we are in relation to the Internet in the coming years, privacy is always among the top listed concerns of most persons. These 2 cases present some additional approaches to the problem…one via governmental action and one via private initiative.
More to come from both arenas I am sure.
© 2001 Ivan Hoffman