Privacy Policies and Litigation
Any business with a website should pay close attention to this article from the South Florida Business Journal (print version), which discusses the obligations that a privacy policy puts on a company.
Trouble can arise if the privacy policy isn’t followed during a company’s marketing efforts, when changing merchant account providers, when changing the policy itself, or when the company is sold. The article reviews the legal and regulatory problems that confronted Toysmart.com, Gateway Learning Corp., and others when they strayed from the privacy promises they’d made to customers.
The main points I took away from the article were:
- Adhere to your privacy policy in all your marketing efforts. Conversely, keep future marketing needs in mind when designing your policy.
- Follow the dictates of your policy if you sell the company. The TRUSTe model privacy policy1 covers this eventuality by promising notification of such a sale. You may also be able to arrange buyout terms that bind the purchasing entity to the same policy that you’ve used. Consult your lawyer for details.
- Make sure that the way you change your privacy policy doesn’t break the terms of the existing policy. Carefully choose the kinds of notification you promise for policy updates, and follow through on them when required.
The bottom line: Before you put a privacy policy up on your site, make sure you know exactly what you’re agreeing to. Once you understand the policy, make sure you follow it.
The TRUSTe model policy provides good guidance, though parts of it might not apply to your particular business. The decision-makers in charge of a company’s website can use both the article and the model policy as points of reference in discussions with a lawyer.
If your usual lawyer or law firm isn’t familiar with Internet privacy issues, you may want to seek referrals to one who is. Any competent attorney should be able to review the relevant precedents, research current trends in the field, and make informed recommendations based the findings. On the other hand all those billable hours may be more expensive than hiring a specialist, and one shouldn’t overlook the value of experience.
Footnotes
1 TRUSTe is an independent non-profit organization that certifies companies as complying with a set of recommended privacy principles. You can download their model policy from this page of their website.