Thank you for sharing!

Your article was successfully shared with the contacts you provided.
Amazon.com has come within the crosshairs of Junkbusters Corp. and the Electronic Privacy Information Center (EPIC) with respect to its privacy policy and perceived threats “to the privacy and intellectual freedom of millions of consumers within the United States.” As a result, Junkbusters and EPIC have contacted attorneys general from a variety of states and the Federal Trade Commission (FTC) asking for greater consumer protection. Time will tell whether government regulators will bite at this bait. PRIOR PROBLEMS Once upon a time, Amazon indicated in its privacy policy that it would not sell personally identifiable information of its customers without customer consent; specifically, customers would be allowed to opt-out of any such sale. However, in late 2000, Amazon told its customers that it might transfer such personal data if the company assets were acquired. This followed events involving Toysmart, a company that sought to sell its customer records in its bankruptcy proceeding, even though it previously promised not to transfer personal customer data. Junkbusters and EPIC complained to the FTC that this amounted to an unfair business practice. While the FTC ultimately did not take action against Amazon, some states initiated investigations into Amazon’s privacy practices. As a result, Amazon has agreed to shed further light on its intended privacy practices, including under what scenarios it might disclose customer personal information, especially in the event of a business transfer. AMAZON’S ‘CLARIFICATION’ AND THE HARSH RESPONSE While Amazon still takes the position that personal data records are assets that can be included in a business transfer, it maintains that the records are still subject to promises made in any prior privacy notice. Junkbusters and EPIC complain that this “clarification” is nothing more than “hypocrisy.” In essence, how can a prior privacy notice promising that personally identifiable information will not be disclosed be reconciled with a current position that such information constitutes a transferable asset? Junkbusters and EPIC, in a letter to the state attorneys general and the FTC, express great concern about the revelation of personal information about readers of Amazon books. They state: “In recent years, access to book sales records has been a matter of significant public concern. In a recent case involving law enforcement access to book lists, the Colorado Supreme Court ruled that a release of book records would violate readers’ First Amendment rights, and that the state would have to demonstrate a compelling state interest to obtain book sales records.” Furthermore, according to Junkbusters and EPIC: “Patrons of libraries are covered by privacy laws or regulations in all states. Additionally, the American Library Association has a strong tradition of protecting individuals’ choices in reading, having adopted protections for patron privacy as early as 1939. … Librarians have even developed technical methods to shield circulation records from exposure. Circulation systems expunge all record of a book being borrowed as soon as the patron returns it.” SPECIFIC RECOMMENDATIONS Having explained the potential problem of permitting the transfer of customer personal data, Junkbusters and EPIC propose four recommended required actions: � Amazon must obtain customer consent before transferring personal information; � Customers must be offered the option to delete the records of specific purchases; � Amazon must allow complete access for a customer regarding personal information collected on that customer, except possibly where such access would thwart an ongoing fraud investigation; and � An independent audit of Amazon’s compliance with its privacy policy must be conducted. NOW WHAT? It is possible that the most recent effort by Junkbusters and EPIC will amount to nothing more than a gnat trying to grab the attention of an elephant. On the other hand, Amazon’s prior change in its privacy policy did lead to governmental investigations, and perhaps Junkbusters and EPIC are fanning a flame that could grow into a conflagration. We shall see. Meanwhile, Amazon would be smart not to compromise the confidentiality of its customers’ personal data. Eric J. Sinrod is a partner in the San Francisco office of Duane Morris, where he focuses on technology and litigation matters. His Web site is sinrodlaw.com and his firm’s site is www.duanemorris.com. He may be reached by e-mail at [email protected]

This content has been archived. It is available through our partners, LexisNexis® and Bloomberg Law.

To view this content, please continue to their sites.

Not a Lexis Advance® Subscriber?
Subscribe Now

Not a Bloomberg Law Subscriber?
Subscribe Now

Why am I seeing this?

LexisNexis® and Bloomberg Law are third party online distributors of the broad collection of current and archived versions of ALM's legal news publications. LexisNexis® and Bloomberg Law customers are able to access and use ALM's content, including content from the National Law Journal, The American Lawyer, Legaltech News, The New York Law Journal, and Corporate Counsel, as well as other sources of legal information.

For questions call 1-877-256-2472 or contact us at [email protected]


ALM Legal Publication Newsletters

Sign Up Today and Never Miss Another Story.

As part of your digital membership, you can sign up for an unlimited number of a wide range of complimentary newsletters. Visit your My Account page to make your selections. Get the timely legal news and critical analysis you cannot afford to miss. Tailored just for you. In your inbox. Every day.

Copyright © 2021 ALM Media Properties, LLC. All Rights Reserved.