Court draws a line for online privacy
In a ruling that helps clarify the limits of digital eavesdropping, an appeals panel says a group of Web surfers can sue a company that gathered certain data without their consent.
The decision, handed down Friday by the First Circuit U.S. Court of Appeals, clears the way for some pharmaceutical Web site users to pursue a class-action case against the operators of Boston-based Pharmatrak. The lawsuit alleges that the now-defunct Web traffic analysis company violated the Electronic Communications Privacy Act (ECPA) by intercepting communications without permission.
The ruling is significant, because the appeals panel attempted to address some muddy legal issues related to online data collection. These questions include what, in the online world, constitutes protected "content" for the purposes of intercepting communications--a technique commonly used by law enforcement agencies.
Under federal wiretap laws, the content of communications (such as a phone conversation) receives a higher level of protection than noncontent (such as the phone number dialed). In the digital world, the subject line and content of an e-mail message would similarly receive more protection than would the "To:" or "From:" line of a message, which merely shows where the message is going to or coming from. But some digital material, such as URL search terms, falls into a gray area that the courts are still trying to clarify.
In this case, the appeals panel found that URL search terms are protected content. Such search terms often appear as a part of a URL after a user types the words into a search box and is sent to a page listing corresponding results. For example, if someone types the words "dogs" and "Labradors" into a search box on a page such as Google, the resulting URL will include the words "dogs" and "Labradors," allowing someone to see what that person searched on simply by looking at the URL.
The appeal panel's decision could be a boon for privacy advocates, who have worried that laws such as the Patriot Act, which expanded the powers of law enforcement agencies in the wake of the Sept. 11, 2001, attacks, gave police and other forces more authority to gather search terms.
By putting URL search terms into the area of protected content, the ruling means that law enforcement agencies would actually have to clear higher hurdles to obtain information about online searches, said Orrin Kerr, an associate professor at George Washington University Law School.
"It's definitely a proprivacy ruling," Kerr said. "It indicates courts are going to adopt a broad view of content. That's significant."
The legal saga leading to the appeal decision started when several pharmaceutical Web sites hired Pharmatrak to cull data about how people used their sites, in order to improve service. However, Pharmatrak allegedly gathered data--including search terms entered into a form--beyond what was requested by the pharmacies and without the pharmacies' permission. A group of the sites' customers sued in August 2000, claiming that information was collected without consent, but a lower court judge refused to allow the case to go forward.
In Friday's ruling, the appeals panel said a lower court was wrong to deny the group the right to pursue a class-action suit, and sent the case back down to the U.S. District Court in Massachusetts for further proceedings.