More and more businesses these days are collecting data from their customers, data like as names and email and snail mail addresses. 

Such information is a valuable asset for business organizations as a closely guarded competitive advantage over competitors or as a source of revenue for sale to third-parties. Unfortunately, some businesses have discovered that, unless handled with care, consumer data can also be a significant liability. 

While some businesses claim an “ownership” in collected consumer data, they must consider the ramifications of disseminating that data or selling it to third-parties. Businesses have obligations to consumers regardless of whether or not they own the information. 

For example, consumer protection statutes do not protect the collected consumer data; they protect the consumers themselves. Further, unfettered dissemination of personal information would also destroy the trust that businesses are constantly trying to develop with customers.

Best practice tips:

• Create a privacy policy. In an ideal world, a privacy policy should closely follow the Federal Trade Commission’s Fair Information Practice Principles. Be transparent and do more than simply tell the customer that information is being shared.  Instead, quantify what data is shared, with whom and how many times. Businesses that plan to sell customer data to third parties should clearly say so in privacy policies. Certain kinds of business organizations are also required to make privacy policies publicly available.
• Obtain informed consent. Ask consumers to agree to the terms and conditions in the privacy policy. Offer consumers an opportunity to opt out of certain terms and conditions regarding use or dissemination of personal information.
• Disseminate carefully. If businesses do disseminate consumer data, follow the terms of the privacy policies. Businesses that do not follow the guidelines in a privacy policy statement are a significant source of Federal Trade Commission enforcement actions. Limit liability further by aggregating the data so that individual detailed information is summarized numerically and anonymously, as is standard practice at many companies. Avoid direct third-party access to consumer data.  Financial and health organizations may have additional rules regarding the use, disclosure and dissemination of customer data.

Businesses have a fundamental interest in protecting their reputations and relationships with customers. A business that offends consumers with its dissemination of personal information spoils its relationships with its customers and wastes the value of the information.

Consumers will heavily penalize businesses that violate consumer trust by taking their dollars to competitors. Or worse, those businesses could stand to be liable under some consumer protection laws.

John D. Martin is a trial lawyer and the managing partner of the Cranfill Sumner & Hartzog LLP’s Wilmington, North Carolina office. Martin concentrates his practice in the medical malpractice and professional liability defense practice groups. He has tried numerous medical malpractice and personal injury cases throughout eastern North Carolina. Many of his cases involve brain injury, birth trauma, paraplegia and wrongful death. Additionally, Martin has experience with large construction litigation, premises liability and hospital/workplace security. To contact Martin, call (910) 777-6018 or email him at [email protected].