Who Knows Where You Live?

By Matthew Dollet-Hemphill.

Who Knows Where You Live?

A Real and Present Danger

On July 29, 1999, Docusearch, Inc.– a “people search website”– was contacted by a man named Liam Youens. He requested their assistance in finding information about one Amy Lynn Boyer. He simply provided some basic information – name, address, phone number– and Docusearch went to work. Their diligent efforts were eventually rewarded with several pieces of information about Boyer, including her work address. Many readers can probably guess what happened next. On October 15, 1999, Youens drove to Boyer’s workplace, shot her, and then shot himself.

Two factors contributed to this tragic occurrence. The first was Docusearch’s failure to ask a very simple question: “Who wants to know?” After all, some digging on their part might well have unearthed Youens’s website dedicated to stalking Boyer. Her mother sued, and in Remsburg v. Docusearch, the Supreme Court of New Hampshire ruled that Docusearch, and other similar websites, had a duty to exercise reasonable care in providing information about third parties to a client. Hopefully, this verdict brought some closure to Ms. Boyer’s family.

Unfortunately, this result is not a common one. Remsburg v. Docusearch is not often cited in other court decisions, and never for the proposition that such websites have a duty to be careful to whom they provide information. That brings us to the second factor – the internet itself.

The Problem as it Stands Today

What can be said about the internet? It will be the savior or destroyer of civilization. It is a place of connection or a place of isolation. A place of unity or of division. A place of truth or of lies. It is all these things, or perhaps none of them, but whatever it is, it’s here to stay.

When Amy Boyer met her tragic fate in 1999, the internet was a pale shadow of the all-encompassing behemoth it is now. It was still relatively new, and there were likely many Americans who had little to no online presence. By 2021, the Pew Research Center reported that 31% of American adults say they’re online “almost constantly.” By January 2022, there were 307.2 million internet users in the United States. With each passing day the internet grows, its tendrils reaching into our offices, our homes, our very pockets. With every search, every video watched, every item bought, we feed it more and more of that which it craves – information. Names, addresses, shopping preferences, inclinations ranging from the innocent to the prurient – all are fed into the gaping maw of the internet. There they are analyzed, compiled, and bartered, before being sold and used to draw users in further.

“We should treat personal electronic data with the same care and respect as weapons-grade plutonium. It’s dangerous, long-lasting and once it’s leaked there’s no getting it back.”  
– Corey Doctorow

For companies like Docusearch, their hunting grounds have never been richer. They can find names, home addresses, emails, and even extremely personal information like social security numbers from a vast multitude of sources. Court records are available online, often uncensored, and simple Google searches can contain names, medical info, and financial information for parties and jurors. Phonebooks, like the classic Whitepages, are now in digital form and contain the names, phone numbers, and addresses of entire towns. Before the internet many of these records, even if technically “public,” would have been kept secret by the principle of “practical obscurity.” Finding a particular name or address would have been an exercise in tediousness and effort, involving going to physical locations such as a courthouse or county records office and digging through massive amounts of paper. Now, things are far simpler and easier, and no one need leave the comfort of their home. You can find anyone, from anywhere.

This state of affairs is intolerable. Fraud, identity theft, cyberstalking, and cyberbullying are already endemic, but contain names, medical info, and financial information for parties and jurors. Phonebooks, like the classic Whitepages, are now in digital form and contain the names, phone numbers, and addresses of entire towns.

Before the internet many of these records, even if technically “public,” would have been kept secret by the principle of “practical obscurity.” Finding a particular name or address would have been an exercise in tediousness and effort, involving going to physical locations such as a courthouse or county records office and digging through massive amounts of paper. Now, things are far simpler and easier, and no one need leave the comfort of their home. You can find anyone, from anywhere.

This state of affairs is intolerable. Fraud, identity theft, cyberstalking, and cyberbullying are already endemic, but added on top is also the very real risk of physical harm. There are undoubtedly many people who have someone they wish to never find them, lest they end up as Amy Boyer did.

What Can Be Done?

This author strongly believes that greater care must be taken to ensure that personal information does not become widely available. Information-search services should be required to restrict what information they provide and to whom they provide it and should have a general duty of care to ensure that the information they provide is not misused. This would mainly be accomplished by attempting to ensure the legitimacy and legality of the purposes for which the information is sought.

There are four methods by which this could be achieved, each with its benefits and downsides. The first method is for courts to begin applying the Remsburg ruling broadly, creating a common-law doctrine of a duty of care regarding the providing of personal data to third parties. The second method would be for the Federal Trade Commission (FTC) to expand its definition of an unfair business practice to include making personal data publicly available without restriction. The third and fourth options are somewhat interrelated, as they both start with a campaign of public pressure for action on this issue. This could be to convince data brokers and other such companies to change their practices – method 3 – such as by adding stricter access requirements to the information they provide. It could also be by driving legislatures to pass new privacy laws regulating this behavior – method 4.

Of these options, this author prefers the fourth – legislative action. The first runs into issues of limited precedent and jurisdictional differences and has the ugly possibility of coming too late. After all, the Remsburg ruling didn’t bring Amy Boyer back to life. The second, relying on the FTC, has promise but runs into issues of the limited rulemaking authority of administrative agencies, especially when recent Supreme Court decisions indicate an unfriendliness to expansions of administrative power beyond the exact letter of the law. The third option is a nice thought, but in this case, it is likely too much to hope that companies can be pressured into changing their practices, as the main culprits have every economic incentive to not change. Their business models rely on having free access to as much information as possible.

In the end, despite the persistent difficulties in getting a privacy law passed anywhere but the state level (or even there, just ask Washington State Senate Bill 5062) in the United States, a federal-level privacy bill is the best solution. It would not have to wait for something to happen, it would not be trammeled by a founding charter like the FTC, and would force companies to take notice.

But if a law is the best answer, what might it look like? This author imagines a three-tiered system of classification for information based on the amount of access to and knowledge of another’s life the data would grant those who know it. At the lowest tier would be “digital contact information” (social media profiles, email addresses, etc.), while the middle tier would contain “physical information” (name, age, gender), and the highest would contain things such as medical history, financial information and physical addresses. The degree of care needed regarding the information, and the strictness of control over access to information, would depend on what tier the question for information resided.

Despite its originality, such a doctrine would not be completely novel. This author argues that it is a logical extension of pre-existing laws. Laws like the FTC’s unfairness doctrine, which punishes lax cybersecurity on the part of companies, due to the risk of substantial injury to consumers through fraud and identity theft. Or the Fair Credit Reporting Act, which sets limits on who can use, and for what reason, personal information for credit, insurance, or employment purposes. These laws show the recognition by courts and legislatures that personal information is a valuable and important commodity that is easily misused and should be regulated for the common good.

This world holds enough to worry about without the concern of who might know things about you you’d rather they didn’t. The author hopes that this article will draw attention to the issue, and perhaps spur a conversation or even action. In the meantime, the author would like to direct the reader’s attention to privacyrights.org/data-brokers. This site provides a comprehensive list of data brokers, with links to a page each broker provides to remove yourself from their search results. If you wish to avoid the tedium of going to each individual site, there are services that will remove you from all such sites at once (for a fee).

 

A graduate of the University of Rochester and The George Washington University Law School, Matthew is passionate about protecting the rights and safety of consumers. Contact him on LinkedIn at linkedin.com/in/lmattdh.