INFORMATION & TECHNOLOGY LAW

Liability for Damage Caused by Selling Personal Information

By Jon M. Garon*
As published in Interface Tech News, April, 2003

In February, New Hampshire Supreme Court broke new ground by finding that a Florida company, Docusearch.com may be held liable for the personal information it sold to a client over the Internet when that client used the information to trace and murder New Hampshire resident Amy Boyer. The murderer, Liam Youens, had been a classmate of Ms. Boyer, where he developed an obsession about her. As his obsession turned fatally destructive, he maintained a website dedicated to his murderous fantasies towards Ms. Boyer. He sought her out, but was unable to locate her phone number or work address, where she would be approachable by Youens.

Eventually, he turned to Docusearch.com for answers. Youens paid $45.00 to obtain his victim's social security number and $109.00 to purchase her work address. Ms. Boyer had been tricked into revealing her employment information through a pretextual call placed by an independent contractor working for Docusearch.com. Ms. Boyer was called at home and lied to in order to get her to disclose the employment information. With this information in hand, Youens drove to Boyer's workplace. When she appeared, Youens first shot Boyer, then turned the gun and fatally shot himself.

According to the New Hampshire Supreme Court, Docusearch.com "is the online incarnation of Docusearch, Inc. and Wing and a Prayer," although its website states that it is owned by Arcanum Investigations, Inc. It is not affiliated with the New Hampshire corporate resource company that unfortunately shares the same name.

The Court decision to extend liability for the actions of Docusearch.com stretch the traditional rule that a person has a duty not to place another person at risk for criminal actions, when the risk of criminal misconduct is substantial and foreseeable. As the Court explained, "threats posed by stalking and identity theft lead us to conclude that the risk of criminal misconduct is sufficiently foreseeable so that an investigator has a duty to exercise reasonable care in disclosing a third person's personal information to a client." The Court also found that the pretext call violated New Hampshire's version of the deceptive trade practices statute (Consumer Protection Act RSA 358-A). This statute makes it "unlawful for any person to use . . . any unfair or deceptive act or practice in the conduct of any trade or commerce…." Since Docusearch.com is conducting commerce in the information, the pretext call is a deceptive practice used to obtain the information, and therefore, illegal. The Court also extended the investigator's duty to the person whose information is deceptively obtained, not simply the purchaser of the information.

There is no doubt that the case is an abhorrent, extreme example posed by the problem of identity theft. Nonetheless, the case may have broader online implications as well, because the Court added that the criminal risk "is especially true when, as in this case, the investigator does not know the client or the client's purpose in seeking the information." Both the sale of the social security number and the pretext call are unfortunately common among private investigators. What the Internet-based investigators add to the mix is the universal availability of such investigative services and the anonymity afforded to the purchasers of these services when the only contact is through a website.

The nearly anonymous nature of Docusearch.com services is illustrated by its own marketing materials. As Docusearch.com explains on its home page:

DOCUSEARCH is the America's premier provider of on-line investigative solutions. Requesting investigative services has never been easier than using our web site. All functions are available with a simple point and click. Our user-friendly interface will prompt you for all the necessary data. Once an assignment is complete, you will be notified by email that the results have been posted in a secure, password protected client area. It doesn't get any easier than that!

For stalkers, identity thieves, unscrupulous collection agencies and others, the Docusearch.com appeal may be too hard to resist. In contrast, Docusearch.com itself recognizes that its cavalier marketing materials overstates its responsibility. Unfortunately, only in the Docusearch.com user agreement does this additional statement appear:

Client will be required to provide a reason for any search that involves non-public, restricted or sensitive information. Client represents and warrants that it will provide Docusearch with accurate and complete information regarding the searches requested, and that search results will not be used for any purpose other than the purpose stated to Docusearch. In the event that Client is alleged to have misused any information provided to it by Docusearch, Client understands and agrees that Docusearch will fully cooperate with its data suppliers and/or government authorities investigating the allegations of misuse.

Although the Court did not focus on this aspect of the case, it seems that Docusearch.com violated its own contract. While the contract claim does not give legal recourse to the estate of Ms. Boyer, the contract terms vividly demonstrates Docusearch.com's awareness of the potential for misuse of the information.

More significantly, New Hampshire has now outlawed pretext calling in all contexts and recognized the private nature of social security numbers for a very expansive range of uses. The New Hampshire Supreme Court has taken a significant step for reasserting privacy rights. The notoriety of Ms. Boyer's murder will accelerate the call for more expansive privacy protection throughout New England and the entire nation. The online nature of the transaction will also focus this attention towards online privacy abuse.

Ultimately, however, the greatest risk to privacy is anonymity. So long as the persons seeking information can remain anonymous behind a web browser, investigators will be unable to assess the legitimacy of the request for information. The game of cat and mouse will continue.

We can only hope that the next investigator will remember Amy Boyer before answering that anonymous request to track down a young woman. Had Docusearch.com only asked why Ms. Boyer's work address was being kept confidential, it may have chosen to assist government authorities instead of Ms. Boyer's murderer. The New Hampshire Court decision may have a profound impact on this growing problem. We can only hope.

*Jon M. Garon is admitted in New Hampshire and California.

Return to top of page

Return to Technology Law Articles
Return to Firm Publications