EFF demand for FTC investigation of AOL raises legal questions

Stan Beer
Wednesday, 16 August 2006 15:59

Opinion and Analysis

The Electronic Frontier Foundation (EFF) has very publicly gone for the jugular of  Time Warner's America Online (AOL). The non-profit watchdog organization has filed a request with the Federal Trade Commission to investigate AOL and posted a proclamation on its website urging AOL users to "take action", after AOL incorrectly released search data from 658,000 members into the public domain.

The EFF version of taking action consists of customers ringing AOL to voice their displeasure at having their privacy compromised and urging their friends to do the same. However, there is not one word mentioned on the EFF site about any possible legal redress for customers who may have had their personal privacy compromised.

AOL has admitted its error and the event clearly contravenes the company's own publicly stated privacy policy. In the vast majority of cases, it is probable that the search data cannot be used to expose the identity of users.

However, cases have already come to light where users' identities and personal details and their search queries have been revealed to the world. In such cases, users may have substantial claims against AOL for damages with accompanying demands for compensation.

If lawyers in the land of litigation are not jumping out of the woodwork trying to get class action suits happening already, they probably soon will be. If or when that happens, other companies that keep user logs will no doubt sit up and take notice.

It is unrealistic to expect the search companies not to keep logs of user searches. Finely targeted advertising based on user search logs is now a multi-billion dollar industry and it is what makes possible the increasingly rich array of free services and applications that are now available to web surfers.

That said, it is clear from the AOL fiasco that the legislative processes governing the storage of user data by corporations are not sufficient to ensure an adequate level of protection for the privacy of users. This is something that needs to change and this may require new and tighter laws.