In a blog entry from last week, the chief privacy officer of Plaxo responded to an article written by David Coursey (""Beware of 'Free' Services") that suggests companies may break their privacy promises when they become desperate for money or a new owner arrives on the scene. Plaxo's principal product is a service to keep your contacts up to date, so it collects a fair amount of personal information.

Plaxo's Personal Card: Are Privacy Policies Unenforceable and Meaningless?

...

The fact is promises made within privacy policies are enforceable, specifically by the FTC. People may be familiar with Section 5 of the FTC Act, which declares "unfair or deceptive acts" are declared unlawful. The FTC has demonstrated in the past that an organization's failure to live up to published privacy practices are considered "unfair or deceptive" and the FTC has taken corrective action to protect consumers in these cases.

In the case of Plaxo, our Plaxo Privacy Policy sums up our privacy practices within the following principles:

• Your Information is your own and you decide who will have access to it.
  
• You maintain ownership rights to Your Information, even if there is a business transition or policy change.
  
• You may add, delete, or modify Your Information at any time.
  
• Plaxo will not update or modify Your Information without your permission.
  
• Plaxo will not sell, exchange, or otherwise share Your Information with third parties, unless required by law or in accordance with your instructions.
  
• Plaxo does not send spam, maintain spam mailing lists, or support the activities of spammers.
  

...

But the question remains, can't an organization simply change their privacy policy at any time?

The answer is yes, but the FTC Act also covers material changes to privacy policies. In speaking with an FTC official at a recent IAPP/TRUSTe Privacy Symposium, I was told the FTC operates under the concept that "a privacy policy walks with the information". In the recent case between the FTC and Gateway Learning, Howard Beales, Director of the FTC's Bureau of Consumer Protection, summed it up by stating, "You can change the rules but not after the game has been played." I direct you to the FTC site for more information: http://www.ftc.gov/opa/2004/07/gateway.htm

Labels: information breaches