Welcome to the MacNN Forums.

Leia's Left Bun · Jan 26, 2006, 04:26 PM

I signed up for an account on a certain Canadian mail order company that clearly says they "do not share any personal information". (Don't think dirty, but I don't want to say who)

I found out TWO days later they had printed a statistical report and gave it to an affiliate company (which they say I signed up through, but didn't) with my first and last name printed on it. I found out because someone i know works at the company they gave it to.

I called them and ask how my first and last name isn't "Personal Information". He say "there are a million John smiths out there". I said ya, but I am the only one with my name in Canada. He said it doesn't matter.

Should I be pissed?

Chuckit · Jan 26, 2006, 04:47 PM

Did they specify what constitutes "personal information," or did they leave it at that?

Leia's Left Bun · Jan 26, 2006, 04:55 PM

Originally Posted by Chuckit

Did they specify what constitutes "personal information," or did they leave it at that?

"We do not sell, trade or rent your personal information to others. We may provide statistics about customers, sales, traffic patterns and related Web site information to reputable third parties, these statistics will include no personally identifying information."

The reason I can't mention who they are as they are a client for a friend of mine. He told me about my name being listed in a kidding matter and I don't want him to get in trouble as a result.

analogika · Jan 26, 2006, 05:03 PM

Your name is most definitely "personally identifying information".

If this had happened in Germany, they'd have broken the law and you could a) inform law enforcement, and b) sue them.

analogika · Jan 26, 2006, 05:04 PM

Your name is most definitely "personally identifying information".

If this had happened in Germany, they'd have broken the law and you could a) inform law enforcement, and b) sue them.

turtle777 · Jan 26, 2006, 05:05 PM

Originally Posted by Leia's Left Bun

Should I be pissed?

Should ?

You are, so yeah, you might as well BE...

-t

Leia's Left Bun · Jan 26, 2006, 05:09 PM

Originally Posted by analogika

Your name is most definitely "personally identifying information".

If this had happened in Germany, they'd have broken the law and you could a) inform law enforcement, and b) sue them.

I am trying to find out about Canada though. I called the government of Canada info line and they pointed me to this link:
http://www.tbs-sct.gc.ca/gos-sog/atip-aiprp/

Hard to find the info I need though.

And to call the BBB but they close at 3pm.
http://www.bbbmwo.ca/

Chuckit · Jan 26, 2006, 05:22 PM

In the Privacy Act, look under the definition of "Personal Information." Specifically, one of the definitions is "the name of the individual where it appears with other personal information relating to the individual or where the disclosure of the name itself would reveal information about the individual." I'm not sure if that's relevant, though, because the law appears to be regarding government institutions. That's the most relevant thing I saw on that page, though.

Leia's Left Bun · Jan 26, 2006, 05:26 PM

Originally Posted by Chuckit

In the Privacy Act, look under the definition of "Personal Information." Specifically, one of the definitions is "the name of the individual where it appears with other personal information relating to the individual or where the disclosure of the name itself would reveal information about the individual."

But is JUST a first and last name with no other info count?

I found this here: http://laws.justice.gc.ca/en/P-21/95414.html#rid-95458

""personal information" means information about an identifiable individual that is recorded in any form including, without restricting the generality of the foregoing,"

"(b) information relating to the education or the medical, criminal or employment history of the individual or information relating to financial transactions in which the individual has been involved"

What is can't figure out is if this applies to any business in Canada or just if you work for the Government.

Chuckit · Jan 26, 2006, 05:32 PM

The law itself appears to apply only to the government, but it looks like you could make a good case for a name being considered personally identifying information under Canadian law. That's my completely uneducated opinion. I'd feel lied to, anyway.

Leia's Left Bun · Jan 26, 2006, 05:41 PM

I'm not sure where to go from this point.

analogika · Jan 26, 2006, 05:49 PM

The thing is - passing your name to another party on a list isn't a problem if you're listed in, say, the phone book.

It IS a problem, however, if that company is giving a list of its customers to a third party, since you're then identified BY NAME as a customer of that company, and THAT is sharing of personal information.

Unless you're doing something illegal, it is absolutely nobody else's business whom you buy from. That is between you and the company, and maybe a credit institute you're using to facilitate a purchase.

turtle777 · Jan 26, 2006, 05:53 PM

Originally Posted by Leia's Left Bun

I'm not sure where to go from this point.

Unfortunately, you might have no case because they haven't shared any critical data (like financials etc.). It just depends how weak or strong the law is. In the US, there is almost no protection of privacy. Maybe a little more in Canada, but definitely a lot more in Germany. I guess you'd just have to swollow it and never do any business with that company again...

-t

Chuckit · Jan 26, 2006, 06:06 PM

Just sharing personal information isn't against the law, but if they promised not to share personally identifying information and did, I don't think that would be kosher in the U.S.

Leia's Left Bun · Jan 26, 2006, 06:13 PM

They also don't have anything in the privacy policy about using Cookies. As far as I know they also have to legally mention how the cookies will be used. In there case they are saying it is how hey knew what affiliate was and remembering my account admin username.

KeriVit · Jan 26, 2006, 10:25 PM

I'm sorry, but perhaps I, like SWG, assumed that by that old notsharing statement, they meant they weren't sharing, it never occurred to me as to "how much" the might share...

It's just wrong if ya ask me.

Leia's Left Bun · Jan 26, 2006, 10:27 PM

Originally Posted by KeriVit

I'm sorry, but perhaps I, like SWG, assumed that by that old notsharing statement, they meant they weren't sharing, it never occurred to me as to "how much" the might share...

It's just wrong if ya ask me.

The scary thing is I would have NEVER known unless I had a connected friend. Think about all the other companies that do this.

Leia's Left Bun · Jan 28, 2006, 12:49 AM

I got an reply to my email from the company, this part is interesting:

"The affiliates do not have access to any part of our system except their own affiliate report which displays customer name, program joined and their affiliate $ amount...

We always advise the affiliates not to share this information with others, however, if they do, we can only give them a warning…"

What a bunch of bull. I actually signed up for an affiliate account to read the policy. It says NOTHING about me going to receive customers names and not to use or share it in any way.

They also say there is nothing they can do about it if they do. Um how about having people sign a document that says they will receive customers names but cannot share it?

Either this guy is flat out lying or he has no clue.

JoshuaZ · Jan 28, 2006, 01:16 AM

Man, I would be pissed. Clearly keep calling until you get ahold of someone with real power, and then bitch them out.

Leia's Left Bun · Jan 28, 2006, 01:25 AM

Originally Posted by JoshuaZ

Man, I would be pissed. Clearly keep calling until you get ahold of someone with real power, and then bitch them out.

Actually that was the OWNER that sent that to me.

This was also interesting:
"We need to provide the name of the customer who joins to legitimize our reports for our affiliates... "

Again, what does legitimize mean? Are they actually saying affiliates will not accept money from them if they don't include names?

"This has never been a concern in the 10 years that I have been in business. "

Ya how about because NONE OF YOUR CUSTOMERS KNOW YOU SHARE THE INFORMATION. If it is not in the privacy policy then how would they ever know the site they signed up with shared the name of the client? If it wasn't for my accidental insider on the matter I would never have know.

Chuckit · Jan 28, 2006, 01:35 AM

It seems like the only way the name would "legitimize" the report is if the name were personally identifying information that could be use to confirm the report. But we know that can't be the case, right?

Geez, slimy.

analogika · Jan 28, 2006, 01:40 AM

Originally Posted by Leia's Left Bun

What a bunch of bull. I actually signed up for an affiliate account to read the policy. It says NOTHING about me going to receive customers names and not to use or share it in any way.

They also say there is nothing they can do about it if they do. Um how about having people sign a document that says they will receive customers names but cannot share it?

Either this guy is flat out lying or he has no clue.

Yes.

Did you sign a document that said they wouldn't share personal information?

If so, they are in breach of contract.

They would be complete toast if this were here in Germany, since they'd also be in breach of the law.

Leia's Left Bun · Jan 28, 2006, 01:50 AM

Originally Posted by analogika

Yes.

Did you sign a document that said they wouldn't share personal information?

If so, they are in breach of contract.

They would be complete toast if this were here in Germany, since they'd also be in breach of the law.

It was an online form but it clearly said and this is a direct quote:
"We do not sell, trade or rent your personal information to others. We may provide statistics about customers, sales, traffic patterns and related Web site information to reputable third parties, these statistics will include no personally identifying information."

They problem is he doesn't consider a name to be "Personally Identifying information".

Also like I mentioned when I signed up for an affiliate account to see if they mention i will receive customer names and not to share or use them there was NOTHING in the agreement about that.

analogika · Jan 28, 2006, 02:15 AM

I think they'd have a tough time explaining to a court exactly how your name and information on which program you've joined isn't "personally identifying".

Leia's Left Bun · Jan 28, 2006, 10:09 AM

How do I put a dollar amount on my damages though if I sue?

euchomai · Jan 28, 2006, 10:33 AM

Originally Posted by Leia's Left Bun

How do I put a dollar amount on my damages though if I sue?

Good question, I have a question now too. What company is it so I can have my name stolen and get some money?!

ghporter · Jan 28, 2006, 10:47 AM

Just your name, by itself, is not "personal information." It relates to customer lists and the like, but at least according to the way U.S. law works, it's not a controlled piece of information. A taxpayer number, drivers' license number, any account number, etc. listed directly in connection with a name makes the combination "personal information." Here's an example. The Privacy Act of 1974 orriginally applied only to U.S. federal employees and the military. A military base operator (working their "locator service" function) could release a person's name and rank, their duty title and duty phone, and their organization/unit. So if you'd called my base and asked about Glenn Porter, you'd have gotten "Master sergeant Glenn Porter's work number is X, and he's the Chief of Maintenance Support for the X Communication Squadron."

That's all public information. They cannot release ANY other information without express, written consent from the individual-and this particular area is something that gets a LOT of attention when regulatory compliance is evaluated, so they are very strict about this.

To make an analogy to the private sector, anything on your business card should be releasable. Now as far as customer data is concerned, if deep down in the company's privacy policy they don't specify what data they share with those third parties ("not personally identifying" is quite ambiguous), then you may have a legal complaint on your hands. Just your name? Maybe even your name and mailing address? Not a major problem in my mind.

Pendergast · Jan 28, 2006, 10:51 AM

This may help.

Leia's Left Bun · Jan 28, 2006, 10:59 AM

Originally Posted by Pendergast

This may help.

Thanks, I have been looking it over but I can't make head or tails of it.

Severed Hand of Skywalker · Feb 1, 2006, 01:12 PM

The owner called me back today after I sent a really nasty email. He said he spoke to his lawyer and they will be removing peoples names from affiliate reports in the future. He also offered me a free month service (all $25 worth).

Guess it is the best I could do.

turtle777 · Feb 1, 2006, 01:16 PM

Well, that's something. I think you achieved more than you could have hoped for.

Severed Hand of Skywalker · Feb 1, 2006, 01:33 PM

Originally Posted by what_the_heck

Well, that's something. I think you achieved more than you could have hoped for.

He seemed rather scared on the phone as in my email I told him I wanted to hear his reply before I filled a complaint to the Privacy Commissioner of Canada.

Also, he only gave me a 1 month subscription but running to a lawyer probably cost him $200.

At any rate, like I said, I wasn't too upset that my friend at the other company got my name, I was more pissed that they would do something like this in the first place and was really looking out for everyone else.

Bad thing is nobody else knows what they were doing or that I helped put a stop to it.

shunt · Mar 24, 2006, 12:07 AM

Originally Posted by Leia's Left Bun

How do I put a dollar amount on my damages though if I sue?

Here ya go...Personal info calculator

...just noticed there's no "name" button....oh well, I tried

Good site to poke around though.

Kevin · Mar 24, 2006, 06:15 AM

I would say posting anything in the channel that someone posted to you in private would be a very jack-assy thing to do.

But that is just MHO.

But let this be a lesson to those that was hurt by it.

Not everyone in here abides by the same moral standards.

Some people only know "attack attack attack"

wdlove · Mar 24, 2006, 08:58 AM

Protecting personal information is becoming a real problem. Fidelity Investments put all the records of their clients including SS# on a laptop. They said it was for a meeting. The laptop got stolen. Along with all that valuable personal information. Fidelity is going to pay for a year of credit monitoring.

Monique · Mar 24, 2006, 09:27 AM

Often we have the laws in Canada but no one will enforce them. I am not talking about murder here but things like privacy act or employees rights or harrassment laws; and it also depends in which province you live in.

So, your name was given well just let it go because you will not win anything anywhere in this country. If you do, it will be a miracle.

ghporter · Mar 24, 2006, 10:47 AM

There are similar laws in the U.S., Monique; they're basically intended to CIVIL enforcement rather than criminal enforcement. You notice that your personal information has been illegally leaked, so you sue the organization that was supposed to properly protect that information from leakage. Civil enforcement is often much easier, as civil verdicts don't require the same standard of proof. This is also much better for enforcement against corporations, since it's almost always possible for the bosses to deflect any and all blame onto some wage slave who was just doing what the boss who could fire him told him to do. All three of the areas you list are civil statutes, not criminal statutes.

Dark Helmet · Mar 24, 2006, 10:53 AM

Originally Posted by Monique

Often we have the laws in Canada but no one will enforce them. I am not talking about murder here but things like privacy act or employees rights or harrassment laws; and it also depends in which province you live in.

So, your name was given well just let it go because you will not win anything anywhere in this country. If you do, it will be a miracle.

In your head or in reality? When I contacted the government about my above problem they were extremely helpful sending me faxes and links to information. They also told me exactly how to file a complaint, what would happen and the consequences to the company.