FTC Warns Site Not To Sell Personal Data

itwbennett writes "The US Federal Trade Commission has warned two people associated with a now-defunct magazine and Web site for gay teens and young men that they would violate the privacy promises the publication made to subscribers by selling their personal information during a bankruptcy proceeding. The FTC, in a letter sent earlier this month, also suggested that the owners of XY Magazine and XY.com would be violating the privacy standards the company had in place before shutting down if they used the subscribers' personal information in a relaunch of the magazine or website. The personal information is listed as part of the debtor's estate in a New Jersey bankruptcy proceeding for Peter Ian Cummings, editor and founder of the magazine. Before the magazine's demise, many of the subscribers lived at home with parents."

Comments

Mr Cummings

[Anonymous Coward]

Is that a stage name ;-)?

Re:Mr Cummings

[cappp]

To put the ruling into scale:

The magazine, published from 1996 to 2007, collected the names and street addresses of about 100,000 subscribers and photographs and articles submitted by about 3,000 former readers, the FTC letter says. In addition, XY.com, which closed in 2009, collected the names, street addresses, e-mail addresses, personal photos and online personal profiles of between 500,000 and 1 million users, the letter said.

. The original FTC letter also makes for an interesting read. They seem to rely both upon the original privacy statements and a broader sense of "fair play" in making their judgement.

In this situation, however, the continued use of the XY PI, even by the existing owner, would not necessarily be consistent with the original purpose for which the data was provided. Indeed, due to the nature of the information, the passage of time, and the closure of the magazine and website in 2007 and 2009, respectively, the continued use of the data may pose privacy risks not reasonably contemplated by subscribers when they provided the data, and not consistent with their course of dealing with the company.

Re:Mr Cummings

[Hognoxious]

Oh btw, armed and aware gay people tend not to be bashed.

http://pinkpistols.org/

Does their logo look like a vulva, or is it just me?

Yet the US gov got Birthday Club data

[AHuxley]

Funny how they cannot sell data, but the US Selective Service "ie draft" seemed to like buying and using data when they wanted it :)
http://en.wikipedia.org/wiki/Farrell's_Ice_Cream_Parlour
The data an American ice cream parlor chain was used to warn young men to register for the draft before their 18th birthday in the early 1980's.
It was all a big Google (mistake) when exposed.

Re:Yet the US gov got Birthday Club data

[Anonymous Coward]

It was all a big Google (mistake) when exposed.

Bah. Stop trying to invent a new /. meme. It's not even funny.

Re:Yet the US gov got Birthday Club data

[pla]

It was all a big Google (mistake) when exposed.

Uh, Mr. Balmer? You misspelled "Bing".

Re:Yet the US gov got Birthday Club data

[Anonymous Coward]

I remember that. My friend and I made up a fictitious friend so we could get an extra birthday sundae each year. Boy were we shocked when we got a Selective Service letter for our "friend" when he "turned 18."

I think that was a couple of years before I tried to use a $2 bill at Taco Bell.

Censorship Software would help protect Children

[Anonymous Coward]

Most teenagers shouldn't have anything to worry about because responsible parents will have programs like Cyber Patrol and CYBERsitter installed to prevent their children and teenagers from accessing these sexually oriented sites. It's funny because under the Australian Internet filter this type of situation wouldn't even be an issue.

[I'll spell this out early on here. I am not a Troll, just offering some political sarcasm, thank you very much. Remember, your Nanny loves you and only wants what's best for YOU].

Re:Censorship Software would help protect Children

[Drakkenmensch]

[Remember, your Nanny loves you and only wants what's best for YOU].

The last cyber-nanny who wanted What's Best For Me was working for SHODAN, and tried to rip me apart with lasers for trying to hurt the egg pods of The Many. Hilarity ensued.

Bad Comparison

[dreamchaser]

Even the submission says it's because the company in question had privacy policies in place prior to going bankrupt. They would be violatinig said policies if they give away or sell the data. Listing it as 'assets' in bankrupcy court when they weren't supposed to sell it in the first place was a mistake by them.

The Selective Service has no such polcies.

Re:Bad Comparison

[Anonymous Coward]

It's pretty typical for any and all contractual obligations over an asset to be tossed in a bankruptcy court. E.g. say you had a patent which you'd sold thousands of covenants not to sue for, in bankruptcy ownership of the patent may be transferred without the obligation not to sue.

The FTC's recommendation is unusual and surprising and I'd expect it to be ignored or fail if challenged in court.

Re:Bad Comparison

[MadKeithV]

The FTC's recommendation is unusual and surprising and I'd expect it to be ignored or fail if challenged in court.

It's going to be a pretty interesting storm if this fails if challenged in court, because it creates a semi-legal avenue for personal information harvesting, bypassing just about all privacy laws (barring perhaps things like HIPAA).
In slashdot terms:

1. 1. Set up facebook-like site with really good privacy rules.
2. 2. Let site grow with lots of safe personal details
3. 3. Go bankrupt.
4. 4. Sell personal information legally for profit.

Re:Bad Comparison

[rollingcalf]

"It's pretty typical for any and all contractual obligations over an asset to be tossed in a bankruptcy court."

However, it's not so simple when an asset held by the bankrupt company wasn't really theirs to sell in the first place. Suppose they had a fleet of cars which were leased. If they go bankrupt during the lease, they have to give the cars back, and cannot sell them.

In a sense, the personal information was leased to company; it was never theirs to sell and shouldn't become theirs to sell just because of bankruptcy.

Re:Bad Comparison

[wowbagger]

"In a sense, the personal information was leased to company...."

In a sense, I am levitating on a force-field right now - of course, that "force field" is created by the atoms of the chair.

In a sense the data was leased; unfortunately that "sense" is not in the sense of the law, or the sense of GAAP, or any "sense" that is legally binding on the company or the bankruptcy court.

What is needed is for companies that collect your data to EXPLICITLY state, as a part of the contract you enter into prior to them collecting the data, "We don't own this data, you do - we are just holding it for you. We have a specific license to use that data in this specific ways, and we cannot change that license without your explicit consent - we must destroy the data if we cannot continue to abide by this contract." (and IANAL so I don't know if that wording would stand up in court).

Only something of that strength would prevent companies from "monetizing your data".

Re:Bad Comparison

[Artifakt]

One of the things I noticed re. Copyright law (a favorite subject for Slashdot, of course): I ran across the copyright indexes of several authors, such as H. P. Lovecraft, who were big on only giving magazines first publication rights, not the standard 'all rights' clause in contracts. Lovecraft was part of the amateur press scene of his time and actually wrote articles about it, aimed at new authors, plus he metioned it in several letters to fellow authors. HPL also died during the depression, and if you look at the copyright history of his work, a lot of stories pass from a single magazine such as Weird Tales, through many different small companies' hands, before the rights ended up being purchased by August Derleth and Donald Wandrei after the depression ended.
      It looks like a bunch of small presses bought republication rights from magazines such as Weird Tales that the magazine may not have actually owned to sell, and passed these around in one standard contract after another. It looks very strange to see four stories published in the same magazine the same year, all passing through different small press owners hands, with a bunch of corporate names that are all swiftly out of existence, have little or no actual publication history, or seem to maybe be nothing but shell corporations. You have to wonder, if Lovecraft is any indicator, if Weird Tales actually took the time to sell off rights to thousands of old stories one at a time, to literally hundreds of separate companies, instead of bundling them somehow. The explanation seems to be that at least some of these contracts came out of bankruptcy courts, which were working overtime in that era. Unfortunately, only a few of these documents have good paper trails, and it's hard to really prove one way or another.
        Given the middle of the Great Depression connection, I've wondered if this was because bankruptcy courts were distributing these assets as part of big pools of similar fluff, without taking the time to check all the details on items they doubtless felt were of little real worth. Probably they were focusing on the physical assets of the companies, where those existed, and didn't expect these 'IP' assets to ever come back into print.
        This may bear out what the OP wrote. In practice, the bankruptcy courts seem to sometimes ignore restrictions in contract whether that's really what the law says to do or not, particularly if the asset is perceived as having little value compared to the rest of what the court has to deal with.

Re:Bad Comparison

[Fractal Dice]

Should datamining be a criminal offense?

I mean, there is this big effort building laws and international standards surrounding and protecting the copyright on databases - perhaps the act of accumulating and correlating personal information in the first place needs to be examined and attached to the same infrastructure?

If you value privacy, then it seems to me that legal restrictions are the logical endgame - as more and more databases of aliases are interconnected and more of our lives moves to online services, living off the grid will be a full time career of paranoia.

Just food for thought.

Re:Bad Comparison

[Dishevel]

Not if your major debit holder is a shell corporation owned by you.

Re:Bad Comparison

[tverbeek]

"The moral of the story is DON'T GIVE YOUR PERSONAL INFORMATION TO OTHERS."

It's rather difficult to have things delivered to you without giving them your name and address. They tend to want credit card info as well.

Re:Bad Comparison

[sjames]

Not really, set up service provider A and client company B. B does all the public work while racking up a huge debt to A. B goes bankrupt and sells off private data in order to pay A. A makes a huge profit.

I have just one thing to say

[Chrisq]

I'll be buggered if I enter my personal details on a gay teens website!

Re:I'm from future

[pla]

And this same news was posted expect for the fact that the magazine was substituted with website. "Before the website's demise, many of the subscribers lived at home with parents."

Self-debasing humor aside, you have rather a significant difference between a site like Slashdot selling out, and a magazine for gay teens.

Most notably, paying for and receiving a physical magazine means the company has your name, CC info, and physical address; Slashdot has a dynamic IP address, a largely anonymous handle, a throwaway contact email address that likely filled with spam and died at least five years ago, and knows my default comment threshold.

Not to mention, society doesn't stigmatize geekdom (these days) quite the same way it does homosexuality. Although I find the Slashdot crowd far more tolerant of such issues than the general public, our "perverse love" of technology rarely gets us lynched.

Where do the subscribers live these days then?

[YeeHaW_Jelte]

"Before the magazine's demise, many of the subscribers lived at home with parents."

And this changed how exactly after the bankrupcy of the magazine?

Maybe a bankrupcy of slashdot would be a good thing for the readers too ...

Re:Where do the subscribers live these days then?

[Skapare]

"Before the magazine's demise, many of the subscribers lived at home with parents."

And this changed how exactly after the bankrupcy of the magazine?

While the subscriber was regularly getting the magazine in its black shrink wrapped form, they knew to look out for it, about what time it would arrive, etc. That ended when the magazine folded, and the subscriber is no longer expecting it to arrive. Or the subscriber has moved on, to college and/or their own place. Suddenly, without expectation, a new mailing arrives. Even if it has the black shrink wrap, the original subscriber is now not there, or even if there, might not be acting in a timely manner, to prevent the parental units from wondering what's in this strange black envelope and physically tearing it open. Now the damage is done where it otherwise would not have had either the magazine continued operation (the subscriber could quit, not renew, or change address, or just keep on expecting it) or if the magazine abandons its list in a restart under new ownership.

Maybe a bankrupcy of slashdot would be a good thing for the readers too ...

OMG! No more kitty porn???

Promises

[Hognoxious]

My understanding was that the US doesn't have anything like the UK Data Protection Act so the company wouldn't actually be doing anything illegal.

Are these promises worth anything? Would it even constitute a breach of contract, i.e. be grounds for a civil action?

Re:Promises

[grantus]

The FTC has actually filed civil lawsuits against multiple companies that the agency thought didn't live up to their privacy promises. The FTC sees the act of breaking privacy promises as a deceptive trade practice that's outlawed in the FTC Act.

Re:Promises

[Skapare]

The data is still in the hands of the original owners. By filing this with the BK court, the FTC has established that it is illegal (unless another party's argument can prevail, and this would most likely have to be litigated in a separate venue, not in BK) for the sale to be made. Effectively, the subscribers have a lien on the data, which amounts to an ownership of the right sale, held by the subscribers themselves, in absence. Selling it might then be considered no different than the sale of stolen goods (which even a BK court cannot do).

Is it a "promise" or a "contract?"

[Anonymous Coward]

There is nothing preventing a company from changing its privacy policy after it has obtained your private information. Hell, there's no law requiring that they even adhere to their own privacy policy.

Nothing to see here. Move along.

Re:Is it a "promise" or a "contract?"

[grantus]

Nothing except the threat of a lawsuit filed by the FTC. The agency has brought several similar cases.

Re:Is it a "promise" or a "contract?"

[hedwards]

Yes, there is. Privacy policy is a part of the ToS in most cases, and should they change it they are required to give those that are subject to it the opportunity to cancel the contract. Which is one of the reasons why companies like MS and Sony are such a joke, because they regularly change their terms, but offer limited ability to opt out, and definitely don't offer the ability to get a full and complete refund for the product affected.

Think positively

[Moraelin]

Well, think positively. As more and more people grow up with CS and clones and other online games, soon we'll have a whole generation who thinks "gay" means "got more than one kill with a sniper rifle" or "won the roll on a piece of loot you wanted too".

And for that matter than "I fucked your mom" is the new "good morning, sir. How do you do?" I can imagine a business meeting in 2020 going something like:

CEO: "And now Mr Stevens the VIP of marketing will present the results from the latest market poll."
Stevens: "I fucked your moms, ladies and gentlemen."
Chorus: "Your mom's fat."
Stevens: "As you can see on this graph, after our latest PR campaign, our brand recognition has risen by almost 20% and the sales by nearly 10%."
PHB from the audience: "Dude, you're gay."
Stevens: "Thank you."

At any rate, they'll probably think that having been subscribed to a gay magazine is like subscribing to some gaming tricks site ;)

Re:Think positively

[hedwards]

Doesn't help any of them that get kicked out of their house today. Or beaten and killed for that matter. Sure it's extreme, but it does happen, and given the fixation by bigots it does happen and over the population of 100k, it's definitely possible that at least one of those is in a situation where that's possible. Not likely as it's a risk to having that kind of publication in that situation, but still.

Re:The morals of outing

[Anonymous Coward]

I'm not sure a person has to make their views widely public in order to participate in democracy.

Of course you have to make your views public if you want to participate in a democracy. Everything but your vote should be public.

Especially political petitions. If you sign a petition, you are expressly making a public statement of your views on a subject. Otherwise, signatures on a petition could never be challenged.

Why would you sign a petition and then expect the fact that you signed a petition to be private?

Re:The morals of outing

[boneglorious]

If you're not willing to stand by your beliefs openly, then you may want to reconsider them. And democracy runs best when people are willing to continually reconsider their beliefs, rather than when people get an idea and then cling to it, regardless of how shamed or secretive they may feel about it.

It's true that sometimes people do fear retribution for political actions, and justifiably so, but the only way to foster an open discourse, where social norms don't favor revenge or retribution, is to be open about one's beliefs and contribute to healthy debate.

Re:The morals of outing

[zstlaw]

Sadly you are mistaken. People do not reconsider beliefs often. In fact attempting to change deeply held convictions can cause cognitive dissonance since many other decisions have been based on that belief. In fact, people with deeply held beliefs often hold those beliefs even more strongly in the face of proof to the contrary. http://www.boston.com/bostonglobe/ideas/articles/2010/07/11/how_facts_backfire/

But that is beside the point. There is no petition here, this article is about the potential outing of a million gay teens. Which could result in eviction, abuse, and other forms of harm. The FTC made the right call I just wish that consumer protections were more broad. Rather than "you can't do this as it violates your privacy policy" I would prefer "you can not sell consumer information as it could do harm".

Imagine if facebook or myspace decided to mine and sell your data. "Ehh who cares, they already do." But studies suggest they can determine where you live, your sexuality, what you are interested in via your connections. So now even if you keep your data private they can probably figure out your birthday, orientation, former residences, etc. Now imagine if you are an actor or musician and have too many gay friends so they sell your info to a anti-gay group that starts protesting at your work and calling your family/friends/co-workers. You lose business partners, sponsorships, your family starts to wonder what you are hiding...

You can not reason with a mob, they have others reinforcing their opinion and peer pressure would prevent most people from backing down. Only a culture of tolerance and/or stronger consumer protection would make this less likely. Right now we have neither. We are sometimes inching towards more tolerance but then I see anti-gay, anti-immigration, anti-Muslim, anti-intellectual materials and I despair.

Re:The morals of outing

[compro01]

No one is trying to prevent people from exercising their civil rights. They are, however, trying to prevent people from perverting an existing institution designed to build families.

So would you be in favour of prohibiting the marriage of heterosexual persons who do not plan on raising children?