Text 28, 106 rader
Skriven 2004-09-11 22:10:53 av Steve Asher (3:800/432.0)
Ärende: US Drivers "Privacy Protection"
=======================================
=====================================================================
[1] EPIC Files Briefs in Support of Driver and Financial Privacy
======================================================================

EPIC recently filed two "friend of the court" briefs in leading
privacy cases.  In the first, Kehoe v. Fidelity Federal Bank and
Trust, the State of Florida sold more than 500,000 of its citizens'
records from motor vehicle registries without their consent for a
penny each to Fidelity Federal Bank.  Fidelity used the records, which
primarily related to individuals who recently bought cars, to send
junk mail solicitations.  Under the federal Drivers Privacy Protection
Act (DPPA), states are obligated to first obtain the consent of
individuals before selling their personal information from motor
vehicle registries.  However, Florida failed to implement the federal
requirement.

At issue in the case is whether a person whose personal information
has been sold must prove that she was actually harmed in order to
recover damages under the DPPA.  Relying upon the recently decided
case Doe v. Chao, in which the Supreme Court held that actual damages
must be demonstrated under the Privacy Act (see EPIC Alert 11.04), the
lower court held that a victim must demonstrate actual harm before
recovering a default award of $2,500 under the DPPA.

The EPIC brief, which was joined by the ACLU of Florida, argues that
victims should receive the award by default, as it is a strong
deterrent to indiscriminate release of personal information.  EPIC
distinguished the Doe v. Chao Privacy Act case from Kehoe, arguing
that the DPPA is one of the few tools available to protect personal
information from unaccountable commercial entities, such as data
brokers and private investigators.  EPIC also argued that the DPPA 
was enacted to protect individuals from mere disclosure of personal
information, as such release has led to high-profile stalking,
robbery, and murder incidents.

Florida's failure to shield personal information in government records
has resulted in a wealth of commercial databases available on Florida
residents that are not available in other states. For instance,
documents obtained by EPIC indicate that ChoicePoint's law
enforcement-oriented "AutoTrackXP" service includes thirty-six extra
databases on Florida residents.  There are also marketing databases 
on Florida drivers, such as "SUV Owners of Florida," that are not
available on other states' residents.

In the second case, EPIC was joined by a coalition of consumer and
civil liberties groups representing 41 million individuals in arguing
that California should be allowed to regulate disclosure of personal
information among financial institution affiliates.  In American
Bankers Association v. Lockyer, financial institutions sued to
invalidate the strong privacy protections of SB1, California's
Financial Information Privacy Act.  That law requires financial
institutions to obtain consent of consumers before selling personal
information to third parties, and allows consumers to opt out of
information disclosure among affiliated companies and companies 
that have joint marketing agreements.  The lower court upheld SB1's
protections (see EPIC Alert 11.13).

Limiting disclosure of personal information is important because there
is no transparency in the use of the data, and because financial
affiliate structures can be enormous.  The coalition brief argues that
SB1's protections are critical because identity theft and fraud are
being driven by insider access to personal information.  The more a
financial institution can exploit information among affiliates, the
greater the risk of fraud.  Furthermore, if the court invalidates SB1,
by implication, a broad range of unrelated laws could be affected.

EPIC also argued that allowing exploitation of personal information
among affiliates would result in three obnoxious data practices:
first, information disclosed to affiliates is not subject to
time-tested "fair information practices" that promote accuracy and
accountability.  Over time, this could result in a return to unfair
practices that led to passage of the Fair Credit Reporting Act or to
new types of abuses.  Second, it could result in "first degree price
discrimination," a practice where a company uses information to
determine the maximum price that a consumer will pay for a service.
Last, it could result in customer discrimination, practices where
businesses either refuse to serve or give disincentives to less
profitable customers.

EPIC's Kehoe v. Fidelity Federal Bank and Trust Page:

      http://www.epic.org/privacy/drivers/kehoe

For more information about drivers privacy, see EPIC's Drivers Privacy
Protection Act and Drivers License Privacy Page:

      http://www.epic.org/privacy/drivers

EPIC's ABA v. Lockyer Page:

      http://www.epic.org/privacy/preemption/abavlockyer

For more information about SB1 and preemption of state law, see EPIC's
Preemption Page:

      http://www.epic.org/privacy/preemption

=====================================================================

Source: EPIC Alert - http://www.epic.org/alert/EPIC_Alert_11.17.html


Cheers, Steve...

--- 
 * Origin: Xaragmata / Adelaide SA telnet://xaragmata.thebbs.org (3:800/432)