Security [LWN.net]

Security news

The value of privacy policies

Most serious web sites post a privacy policy describing what the site's owners will do with data collected from and about the site's users. For users who are concerned about the spread of their personal information, a strongly-written privacy policy can be a reassuring feature. A recent court ruling, however, suggests that web privacy policies may not be worth the paper they aren't printed on, at least some of the time.

Northwest Airlines was recently faced with a class-action lawsuit headed by some of its customers, who were upset that the airline had provided passenger name record (PNR) data to the U.S. government after the September 11 attacks. The plaintiffs made several allegations, including the violation of various laws and, crucially, breach of contract as a result of Northwest's failure to live up to its privacy policy.

The policy reads, in part:

When you reserve or purchase travel services through Northwest Airlines nwa.com Reservations, we provide only the relevant information required by the car rental agency, hotel, or other involved third party to ensure the successful fulfillment of your travel arrangements.

There is nothing here about giving PNR data (which includes hotel and car information, along with credit card numbers) to interested governmental agencies. One might well conclude that the privacy policy has been breached.

The court struck down the breach of contract claim, however. The reasoning was:

The privacy statement on Northwest's website did not constitute a unilateral contract. The language used vests discretion in Northwest to determine when the information is "relevant" and which "third parties" might need that information... Moreover, absent an allegation that Plaintiffs actually read the privacy policy, not merely the general allegation that Plaintiffs "relied on" the policy, Plaintiffs have failed to allege an essential element of a contract claim: that the alleged "offer" was accepted by Plaintiffs.

The implications are clear: weasel words in a privacy statement can be used against you. If you ever think you may want to take a site operator to court for the violation of a privacy statement, you will, at a minimum, have to be able to show that you read that statement before the violation occurred. It seems unlikely that many potential plaintiffs in privacy policy cases will be able to make that demonstration. Privacy policies, thus, may not be worth a whole lot - at least, not in countries which lack more general restrictions on the use of personal data.

(For the curious, the full ruling is available in PDF format).

Comments (3 posted)

Evans Data on Linux security

Evans Data has sent out a press release about a Linux security survey done by the company. "Ninety two percent of survey respondents indicated that their Linux systems have never been infected with a virus, according to Evans Data's new Summer 2004 Linux Development Survey." The PR lacks an answer for the most interesting question, however: what, exactly, happened to the other 8%?

Comments (28 posted)

New vulnerabilities

courier: cross-site scripting vulnerability

Package(s):

courier

CVE #(s):

CAN-2004-0591

Created:

July 23, 2004

Updated:

August 4, 2004

Description:

The sqwebmail application has a cross-site scripting vulnerability. An attacker can inject and execute a web mail script via an email message.

Alerts:

Gentoo	200408-02	2004-08-04
Debian	DSA-533-1	2004-07-22