Suit Accuses Website Operator Of Massive Privacy Breach
Attorney General Spitzer today sued a company responsible for what is believed to be the largest deliberate breach of privacy in internet history.
The suit against web site operator Gratis Internet alleges that the company sold personal information obtained from millions of consumers under a strict promise of confidentiality.
"Unless checked now, companies that collect and sell information on consumers will continue to find ways to erode the basic standards that protect privacy in the internet age," Spitzer said.
Spitzer's office began an investigation of companies involved in "data mining" or compilation and sale of marketing lists, early last year. The focus of the investigation quickly turned to Gratis, a Washington, D.C. -based company that owns and operates several web sites that provide consumers with ways to receive free products, generally through free trials of yet other products. These sites include or have included: FreeiPods.com; FreeCDs.com; FreeDVDs.com and FreeVideoGames.com.
From 2000 through 2004 Gratis made numerous explicit promises to the users of its web sites about protecting personal information. Among the promises the company made were:
"We will never give out, sell or lend your name or information to anyone"
"We will never lend, sell or give out for any reason your email address or personal information"
"We at [Gratis web site] respect your privacy and do not sell, rent or loan any personally identifiable information regarding our customers to any third party" and
"Please note that we do not provide your E-mail address to our business partners."
Even on its sign-up pages, Gratis promised consumers that it "does not . . . sell/rent emails."
Leading privacy advocates praised the lawsuit:
Marc Rotenberg, the Executive Director of the Electronic Privacy Information Center based in Washington D.C. said: "Without strong enforcement, privacy policies are meaningless. We support the efforts of the New York Attorney General to safeguard consumer privacy."
The suit also sets forth how, during the course of its investigation, Gratis repeatedly, but falsely, denied that such data sharing had even occurred. In one written response to the Attorney General, for instance, Gratis assured the Attorney General that "at all times during its existence . . . Gratis has never sold, rented, or lent email addresses or personal information of its users to any third-party and the company has always maintained control over and ownership of such information."
The Attorney General's suit cites specific data sharing contracts, as well as testimony and other evidence provided by internet marketers that did business with Gratis. The suit, filed in New York State Supreme Court, seeks penalties and injunctive relief, against Gratis and its principals, under New York's consumer fraud statutes
The lawsuit follows the Attorney General's settlement, earlier this month, with e-mail marketer Datran Media, to whom Gratis had sold its user records.
This matter was handled by Assistant Attorney General Karen Geduldig of the Attorney General's Internet Bureau, under the direction of Ken Dreifach, Chief of the Internet Bureau, and with the assistance of fraud analyst Sibu Thomas.