Privacy Policies As a One-Way Ticket

The Gripe Line Weblog ^ | August 3, 2004 | Ed Foster

[Still Thinking]

All those upset about the recent court decision that said Northwest Airlines' privacy policy doesn't count, raise your hand. And, while your hand is up there, use it to slap yourself upside the head. What, you thought vendors' privacy policies gave you even a little bit of protection?

Although it's been almost two months, there still seems to be considerable consternation over a U.S. district court ruling that said it was OK for Northwest to violate its posted privacy policy in giving passenger records to NASA. As much as the case has upset people, though, it really isn't saying anything we didn't already know.

Much of the attention has focused on the judge's statement that the plaintiffs didn't claim to have read the privacy policy at the time and therefore shouldn't expect it to be enforced. It's a point that certainly strikes consumer advocates as strange, since we're always being told that consumers are bound by the terms of a sneakwrap license agreement even if they don't read it. So shouldn't they also be protected by the terms of privacy policy they didn't read?

You'd think so, but that's ignoring the real point the judge was making: privacy policies aren't contracts at all, at least not as far as vendor obligations go. "The privacy statement on Northwest's website did not constitute a unilateral contract," the decision read. The language gave Northwest wide discretion, but even "if the privacy policy was sufficiently definite and Plaintiffs had alleged that they read the policy before giving their information to Northwest, it is likely that Plaintiffs' contract and warranty claims would fail" as they could not prove what contractual damages they had suffered. "General statements of policy are not contractual," the court quoted from a previous case.

In other words, there is really nothing to hold a vendor to the word of its privacy policy. And didn't we already know that? After all, what's the point of Trust-e and other "self-regulatory" privacy organizations except to prevent any real enforcement of vendor violations? Recall what happened to Microsoft's Trust-e certification when it was caught red-handed collecting information about customers in contradiction of its stated policies - it didn't even lose its Trust-e seal.

So are privacy policies completely meaningless? No, unfortunately, they are not. All their meaning, though, is in the privacy rights you surrender to the vendor. And at a later date we're going to have to talk about the role of privacy policies in the "Do Not Call" list era. For now, though, just remember the lesson that Northwest has taught us. Privacy policies are a one-way ticket for your information to fly away.

[tahiti]

"All their meaning, though, is in the privacy rights you surrender to the vendor."

I have two questions about this remark. p 1--What part of the U.S. Constitution allows for a "privacy right?" (Hint: It does.)

2--How did the U.S. Constitution get jurisdiction on private property?

[CJHughes]

Obviously the key is to not give these companies the information they're putting into these databases in the first place. If that means you can't participate in the activity for which such information gathering is allegedly required, then that's your choice.