Industry View

Should You Publish a Privacy Policy?

Security consultant Robert Weingarten explains why publishing a privacy statement may be more harmful than not publishing one.

By Robert Weingarten

September 25, 2006 — CSO —

In the spring of 2000, Eli Lilly and Company launched Medi-messenger, an e-mail service associated with the companyâ¬"s ProzacÂ® website. Interested subscribers enrolled in the program at Prozac.com, and subsequently received their own personalized e-mail reminder regarding their medication. At the time of enrollment, subscribers were invited to view the Prozac.com privacy statement, which said that the privacy and confidentiality of the personal information subscribers provided would be protected.

In mid-2001, Eli Lilly decided to discontinue the Medi-messenger program. An Eli Lilly employee created an e-mail message using the Medi-messenger enrollment information and sent a single message addressed to all 669 subscribers, stating that the service was being terminated.

The Federal Trade Commission (FTC) contended that by making visible the e-mail addresses of all its Medi-messenger subscribers in a single message, Eli Lillyâ¬"s claims of protecting subscribersâ¬" privacy constitutes unfair or deceptive acts or practices because inadequate measures were implemented to protect Medi-messenger usersâ¬" provided private information. Although Eli Lilly unintentionally disclosed private information, it did not admit to violating any laws; yet it agreed to provide more internal security measures to protect end user privacy, and to provide yearly written reviews by qualified persons of its security measures.

This case demonstrates a complication relating to companiesâ¬" claiming that they have security measures to protect their end usersâ¬" privacy. Large, established companies, like Eli Lilly, understand this issue but may still have problems ensuring compliance to their privacy policy. But many emerging companies immediately post their claimed privacy policies on their company websites. These companies often fail to assess the potential risks, burdens and liabilities associated with publishing a privacy policy. They do not realize that publishing a privacy statement may be more harmful than not publishing one.

When a Privacy Policy Is a Deceptive Practice

The FTC initiated the Eli Lilly case based on the companyâ¬"s having inadequate security measures to support its stated privacy policy. The FTC is not the only government agency pursuing deceptive, misleading and/or unsupported privacy policies. By year-end 2005, 15 states had enacted privacy laws that outline what actions should be taken when a breach of private information occurs. Other states, such as New York, use general business laws to handle breaches of private information.

New York State considers a companyâ¬"s privacy policy as part of the â¬Scontractâ¬ between the company and its website end users. If a company states in its privacy policy that it protects private information and then fails to do so, the company can be held liable for deceptive practices.