Sunday, September 3, 2006

Personal Information

This email is a twist on a common issue:

Beginning this month (JULY '06) a new database will be available to the general public free of charge that displays your personal information (names, addresses, phone numbers, birth dates). (Soc. Sec. is available for a price.) The database is found at http://www.zabasearch.com/ type in your name and check … you’ll be SHOCKED as I was!

I urge you to forward this email to family and friends. Check to see if your name and information is in their database. If so and you want it removed, send them an e-mail at info@zabasearch.com <mailto:info@zabasearch.com>

to request it be removed. I do not know how our names are appearing there, but I checked my own and a few other random ones and they are all in this database!

After opting out by email, check back after a few days to make certain your information has been removed. If it has not been removed then file a complaint with your State’s Attorney General.

The first thing to know about this is that there is one very misleading piece of information in here about ZabaSearch: they are not new. They’ve been around since at least 2004 (and quite possibly much earlier, perhaps under another name). Emails like this seem to circulate every few months, always with at recent date in them — this makes me suspicious that it’s actually an example of “viral marketing", started by the firm itself.

Most people don’t seem to realize just how much information about themselves is in the public domain, available either for free (generally from government sources or advertising venues such as the telephone book) or for a small fee. An even bigger surprise to most people is the fact that dispensing such information is perfectly legal. While ZabaSearch offers the ability to block your name, they have no legal obligation to do so (and the notion of getting your state’s Attorney General involved is therefore useless) — because every bit of information that they make available, free or paid, is publicly available and completely legal to obtain and publish.

The notion of “publicly available” — the opposite of private — works (under American law) differently that most people expect. We Americans do not have the right to declare any particular information as “private” and thereby prevent others from discovering or publishing it (this right does exist in some other countries). Instead, we have a system here that recognizes only two mechanisms for keeping information private: laws about specific kinds of information, and secrets that you keep yourself.

The legally protected information is really quite limited. We have laws about health care information (HIPA), about Social Security Numbers, about credit or financial information, and a few other things — but that’s it. Just about any other information about you is unprotected by the law.

However, we Americans have a second mechanism available to us: we can keep any information we want to as a secret, only disclosing it to people or companies with whom we have a contract to keep that information secret. To most of you this probably sounds extreme — and to be sure, it takes a lot of work — but there actually are people who do this. This is actually exactly the same mechanism by which a company keeps a trade secret.

For example, suppose you didn’t want your address to be publicly available information. Here’s what you’d have to do. First, you’ll have to move, since presumably your current address is publicly known (e.g., you didn’t keep it a secret from everybody). When you buy a new place, you’ll have to buy it through an attorney, so your name doesn’t show up on the records. Anyone who learns your name during the purchase process (for example, the realtor or mortgage broker) will have to sign a non-disclosure agreement (a contract) before you do business with them. Trust me, they’ve seen these before — this is how celebrities who want privacy buy their homes. Next, you’ll need to set up a P.O. Box (through the post office, or a private one if they will sign a non-disclosure agreement). Then all your mail and packages go there, and you don’t need to give out your address for routine matters. You’ll still have a few things happen in your life where you’ll have to give your address (such as your employer, when you go to work there) — but you just get all them to sign a non-disclosure agreement and you’re protected.

If you do all that, you have a protectable secret — you can take successful legal action against anyone who discloses it. But…if you ever make a single mistake, disclosing that address to even one person or company without a non-disclosure agreement, then all bets are off and your address is now public information. Any legal action you took against someone disclosing it would then fail, as your address would then be considered to be in the public domain.

You can take similar measures to protect any information you want to, and you could be successful with them. But that’s the only way under American law. You are free, under our legal system, to sue anyone you want to after they have disclosed information, if that disclosure has harmed you. The track record of such suits is quite poor, especially when the information involved isn’t of a nature most people (e.g., jury members) would consider private.

Lots of information about you is clearly in the public domain, and in ways that I think most people are unsurprised by. For example, if you’re in a public place (i.e., somewhere there is no “expectation of privacy"), anything you say, and anything that can be publicly observed about you, is in the public domain. If you’re walking into the grocery store, and someone wants to take a photo of you — that’s their right to do so, and they can do anything they want to with that photo, so long as it wasn’t libelous or protected in some other way. If I was sitting next to you at the theater, and I overheard you telling your spouse that you just got a raise to $27 an hour, I could take out a newspaper ad and publish that information — you gave up your privacy on that by talking about it in public.

Another surprise for most people is that they have explicitly given permission — many times! — for companies to distribute their personal information to whomever they want to. For example, in the fine print of virtually every magazine subscription, there’s a section where you’re specifically granting the publisher the right to “share” your name, address, and phone number with anyone they want to. They sell this information (and on many magazines, that’s their primary revenue) to anyone who will pay them — and you gave them permission to do so. Such agreements pop up in the strangest places these days — I once found one in a rental car agreement (who reads them, other than kooks like me?), and in a car parking garage’s agreement (printed in teensy little type on the back of the ticket). Often when you apply for a job you’ll sign something like that — and when you apply for credit. I could go on and on here, but the real point is this: out of an abundance of caution, many companies are asking your permission (even if, strictly legally, they don’t need it) to distribute your personal information — and you’re giving it to them!

The result of all this is that firms like ZabaSearch can easily — and perfectly legally — publish and/or sell this “private” (but not really) information about you. This is nothing new — I was using such firms back in 1992 to check out people applying for a job at the company (Stac) I then worked for. The first few reports I got (for $25 and a phone call) just about blew me away — I couldn’t believe I could legally (not to mention easily) get this information. The only things new about ZabaSearch and their ilk (there are several dozen of them) is that they’re on the web, and they have the “teaser” of some free information. Otherwise they’re just like “investigations” firms that have been around for well over 100 years.

I mentioned earlier that some countries have privacy laws that work much different than ours here in the U.S. For example, in much of Europe it is illegal for any company to to disclose your address or phone number, unless you’ve given them explicit permission to do so. What happened when these laws were passed is quite interesting. Very generally, businesses have sorted themselves into two categories: either they do need your address (either for practical reasons, such as the pharmacist, or for revenue, such as a magazine), or they don’t. Those businesses who do need your address — even if they have no intention of disclosing it — get your permission to do so, and they won’t do business with you unless you grant it. This permission then protects them against the consquences of disclosure, whether intentional or not. The other companies simply never take your address. In the end, I’m not sure this is really any different than the situation we have here…

My recommendation: this isn’t something to get yourself in a dither about. I think it’s an unavoidable consequence of living in modern times. If it really disturbs you, consider moving to Papua New Guinea…and privacy will no longer be worrying you…