The Federal Trade Commission has some strong words for the former publishers of a defunct magazine and website for gay youth: don't sell or use personal information provided by your customers. It's probably illegal.
The warning came during a contentious bankruptcy proceeding filed by the publisher of XY Magazine, which was a widely circulated magazine for gay teens published from 1996 to 2007. The publisher also operated XY.com, a dating website for gay youth that at one point had as many as a million users. XY's privacy policies promised customers that their personal information would not be given or sold to anybody.
Now the publisher and his former business partners are fighting over who owns the customer information, which includes names, street addresses, phone numbers, credit card numbers, email addresses, personal stories submitted by readers, online profiles, contact lists, and photos, among other data.
In a letter (pdf) to the publisher's former business partners, the Federal Trade Commission said that any sale or transfer of the customer information would violate XY's privacy promises and likely the Federal Trade Commission Act, which prohibits unfair and deceptive acts and practices.
The FTC also suggested that any continued use of the information — even by the publisher himself — might disclose the customers' identities to third parties, which could also violate XY's privacy policies and the law. The Commission asked that the data be destroyed "to avoid the possibility that this highly sensitive data could fall into the wrong hands."
EFF has been keeping a watchful eye on this case, and is glad to see that the FTC is too.
The XY customer information reveals the sexual preferences of more than a million men. Some of them may be openly gay, but others may not want certain people — like family members or employers — to know their sexual orientation or that they explored their sexuality when they were younger. If disclosed either purposefully or unintentionally, this information could cause severe personal and professional repercussions. The privacy interests of the customers outweigh any limited commercial value this outdated but extremely sensitive information might have to anyone else.
Like the FTC, we believe that the XY customer information should be destroyed. This is the best way to ensure that the data will never be disclosed to anybody — as XY promised — and to protect the customers from potential harm. We hope the bankruptcy court will agree.