Court: Information Brokers Can Be Liable
The New Hampshire state Supreme Court ruled yesterday that information brokers can be held responsible when the data they sell puts people at risk involving criminal misconduct.The case involved the October 1999 fatal shooting of 20-year-old Amy Boyer of Nashua, NH, by Liam Youens. Youens, who had been stalking Boyer, obtained her birth date, Social Security number, home and work addresses from online information provider Docusearch.com.
Youens killed himself after shooting Boyer. Boyer's mother, Helen Remsburg, filed suit in federal court claiming Docusearch violated Boyer's privacy and broke numerous other laws.
The federal court asked the New Hampshire Supreme Court to rule on the lawsuit's validity. In its ruling, the state court said information brokers and private investigators could be held liable for "foreseeable harm" that may result from disclosing personal information to a client.
The court's ruling defined foreseeable harm to include cases of stalking and identity theft only. But its definition of "information brokers" is broad enough to encompass many kinds of companies, including some that serve direct marketers, said Chris Hoofnagle, deputy counsel with the Washington-based Electronic Privacy Information Center.
"The opinion is broadly written," Hoofnagle said. "The definition there is a company that sells information for profit."
The ruling is the first time a court has found that brokers are responsible to the people about whom they sell information, Hoofnagle said. It could be the most important privacy decision of the year, he added.
Information brokers have "a duty to exercise reasonable care in disclosing a third person's personal information to a client," especially when the broker doesn't know the client's purpose, the state court wrote.
The court also ruled that brokers can be sued for privacy invasion for obtaining Social Security numbers without permission and be held liable for damages resulting from obtaining a person's work address through the use of pretexting, or lying about one's identity to collect information. Docusearch obtained Boyer's Social Security number from a credit report header and her address by hiring a subcontractor to pose as an affiliate of Boyer's insurance provider.
The case now will return to federal court where a trial on the facts of the case will be conducted, Hoofnagle said.
