Thanks to Rob Hyndman for pointing me to the following article on Findlaw.

A recent FTC consent order may have significant repurcussions for those in the United States who may want to change their online privacy policies to allow them to use information in new ways.

Modern Practice - Privacy Policies: Beware of Changes:

"By Justine Young Gotshall
March 2005

If you operate a web site, you should take note of a recent Federal Trade Commission ("FTC") consent order, In re Gateway Learning Corp., which is the first FTC case to challenge deceptive and unfair practices in connection with material changes to an online privacy policy.

Specifically, the FTC's complaint charged Gateway Learning Corporation ("Gateway Learning") deceived consumers by materially changing its already established privacy practices, revising its privacy policy to reflect these revisions, and retroactively applying the materially different privacy terms to personal information that was collected from consumers under the original privacy policy.

...

In the settlement agreement, Gateway Learning is barred from: (1) making misrepresentations about how it will use consumer data, (2) sharing any personal information it collected under the earlier privacy policy without express consent from consumers, and (3) applying future material changes to its privacy policy retroactively without consumer consent. Gateway Learning was also required to give up the money earned from the rental of consumers' information.

The lessons learned are that a web site must take steps to ensure that it fully complies with each promise set forth in its posted policy privacy and elsewhere on the web site, and that a web site cannot change its privacy practices without consumer consent. A mere statement in a privacy policy that the web site may change its policies and post those changes on the web site does not give the web site the right to retroactively apply the changes to data previously collected. Web sites should also evaluate how they notify consumers when a privacy policy is revised.

...

© 2004 Wildman, Harrold, Allen & Dixon LLP"

Canadians will want to take a look at Kanitz v. Rogers Cable Inc. (2002), 58 O.R. (3d) 299 (S.C.J.), which gives more latitude when changing online contracts, as long as you have given notice that you may do so from time to time.

Labels: information breaches