THE STATE OF NEW HAMPSHIRE
SUPREME COURT

2002 TERM

CASE NO. C-00-211-B

ESTATE OF HELEN REMSBURG
Plaintiff-Appellant

v.

DOCUSEARCH, INC., ET AL.
Defendants-Appellees

ON ORDER OF CERTIFICATION PURSUANT
TO RULE 34 FROM THE
UNITED STATES DISTRICT COURT
FOR THE DISTRICT OF NEW HAMPSHIRE

AMICUS BRIEF OF THE ELECTRONIC PRIVACY INFORMATION CENTER

STATEMENT OF AMICUS CURIAE

Amicus Electronic Privacy Information Center ("EPIC") is a public interest research center in Washington, D.C. that was established to focus public attention on emerging civil liberties issues and to protect privacy, the First Amendment, and other constitutional values.

 

QUESTIONS PRESENTED

I.

Under the common law of New Hampshire and in light of the undisputed facts presented by the case, does a private investigator or information broker who sells information to a client pertaining to a third party have a cognizable legal duty to that third party with respect to the sale of the information?  (Order of Certification at 2.)

II.

If a private investigator or information broker obtains a person's Social Security Number from a credit reporting agency as part of a credit header without the person's knowledge or permission and sells the Social Security Number to a client, does the individual whose Social Security Number was sold have a cause of action for intrusion upon her seclusion against the private investigator or information broker for damages caused by the sale of the information?  (Order of Certification at 2.)

III.

When a private investigator or information broker obtains a person's work address by means of a pretextual telephone call and sells the work address to a client, does the individual whose work address was deceitfully obtained have a cause of action for intrusion upon her seclusion against the private investigator or information broker for damages caused by the sale of the information?  (Order of Certification at 2.)

IV.

If a private investigator or information broker obtains a Social Security Number from a credit reporting agency as part of a credit header, or a work address by means of a pretextual telephone call, and then sells the information, does the individual whose Social Security Number or work address was sold have a cause of action for commercial appropriation against the private investigator or information broker for damages caused by the sale of the information?  (Order of Certification at 3.)

V.

If a private investigator or information broker obtains a person's work address by means of a pretextual telephone call, and then sells the information, is the private investigator or information broker liable under N. H. Rev. Stat. Ann § 358-A to the person it deceived for damages caused by the sale of the information?  (Order of Certification at 3.)

STATEMENT OF THE CASE

We adopt the procedural history and facts as stipulated in the Order of Certification from the United States District Court for the District of New Hampshire.

In addition, we note the following facts from the Plaintiff‚s Memorandum of Law in Support of Her Objection to Docusearch Defendants Motion for Summary Judgment ("Pl. Memo").  First, Defendants Dan Cohn and Kenneth Zeiss attempted to verify that their clients planned to use the information they were providing to them in a lawful way (Pl. Memo at 15-16.)  Also, the Defendants explicitly mentioned "jealous ex-boyfriends" and harassers as the types of clientele they sought to avoid.  (Pl. Memo. at 15-16.)  Second, the killer, Liam Youens, maintained an Internet site detailing his obsession with Amy Boyer and his plans to murder her.  (Pl. Memo at 14.)  Finally, the victim, Ms. Boyer, chose to limit the dissemination of certain information.  She did not put her Social Security Number on her driver's license.  (Pl. Memo. at 3.)  Her name was not included in the household directory listing.  (Pl. Memo. at 3.)  She held few credit cards, and subscribed to only one or two magazines.  (Pl. Memo. at 3.)

SUMMARY OF ARGUMENT

Private investigators and information brokers have a legal duty to act with due care toward the subjects of their investigations.  Because of their unique knowledge of the sensitive nature of the information they uncover and the intentions and background of the clients who request that information, these investigators are in a position to judge the possible harm that could result.  In this case, the harm was eminently foreseeable based on the Defendants‚ own knowledge and the danger inherent in the information they sold.  Further, without an effective tort remedy, private investigators and information brokers would rarely be held accountable for their contribution to the harm experienced by victims of stalkers and identity thieves.

A private investigator or information broker intrudes upon the seclusion of a third-party when he uncovers and sells her Social Security Number to a person who intends to harm her.  The Defendants' extraction of the Plaintiff's number in order to profit from its sale to her stalker is both an intrusion into something private and unambiguously unreasonable conduct.  Social Security Numbers are extremely important to proving one‚s identity for financial and other purposes; the unauthorized distribution of that number violates the privacy interests of the owner and subjects her to the risk of fraud and personal harm.

Similarly, the use of deceitful pretextual phone calls to trick the Plaintiff into revealing personal information is a despicable intrusion into her private affairs.  Private investigators are regularly held liable for privacy violations when their investigations go beyond the lines of decency.  The tactic of extracting personal information by impersonating someone who the victim may trust has been widely denounced and legislatively banned in many states and by the federal government, which is evidence of the societal disgust felt toward the practices in which the Defendants engaged.

We urge the New Hampshire Supreme Court to expressly recognize a cause of action for commercial appropriation, and extend a remedy to private individuals who are injured as a result of the commercial brokerage of their personal information.  Twenty-six states provide some form of protection against commercial appropriation. However, New Hampshire citizens have no legal recourse when the thriving information brokerage industry inflicts harm upon private individuals by collecting and selling their personal information without their knowledge or consent.

Finally, as the New Hampshire Supreme Court considers whether Defendants have violated the New Hampshire Consumer Protection Act, it should examine the position the Federal Trade Commission has taken on pretextual phone calls.  The FTC has determined that pretexting is likely an unfair and deceptive practice, and has initiated litigation against information brokers that have used pretexting to obtain financial information.  The policy reasons underlying the FTC's stance against the pretexting of financial information apply equally to pretexting used to obtain other types of personal information.

ARGUMENT

I. UNDER THE FACTS OF THIS CASE, A PRIVATE INVESTIGATOR OR INFORMATION BROKER WHO SELLS INFORMATION TO A CLIENT PERTAINING TO A THIRD PARTY HAS A COGNIZABLE LEGAL DUTY TO THAT THIRD PARTY WITH RESPECT TO THE SALE OF THE INFORMATION. 

A tortfeasor may be found negligent for the breach of a duty to a third party if foreseeable harm results.  Hungerford v. Jones, 143 N.H. 208, 209 (1998) (finding a mental health care professional liable for negligent diagnosis of plaintiff's daughter as the victim of sexual abuse by the plaintiff); Spherex, Inc. v. Alexander Grant & Co., 122 N.H. 898, 903-04 (1982) (finding an accountant liable for the ill-effects of defendant‚s work on a third party).  Whether or not the plaintiff has a direct relationship with the defendants, courts find negligence where the defendant breached a duty to the victim and the victim as a proximate result suffered harm.  Ronayne v. State, 137 N.H. 281, 284 (1993).

In this case, the harm to the victim is obvious, dramatic and occurred in connection with actions performed by the Defendants.  (Order of Certification at 6.)  To determine whether the harm is the result of a breach of a duty, this Court requires an examination of several factors: "the societal interest involved, the severity of the risk, the likelihood of occurrence, the relationship between the parties, and the burden upon the defendant."  Hungerford, 143 N.H. at 211.  The liability of the Defendants rests on the foreseeability, likelihood, and severity of harm to Ms. Boyer as a result of the information they supplied to her killer and the social interests involved in holding the Defendants liable for their negligence and indifference -- not upon the existence of a relationship between Ms. Boyer and Docusearch.  See id.

A. Because Private Investigators Exercise a Tremendous Amount of Control over the Personal Information of the Subjects of Their Investigations, They Have a Duty to Exercise Due Care With Respect to Release of that Information.

When harm may foreseeably result from a person‚s dangerous actions and he fails to exercise due care to prevent that harm, he has breached his duty to the victim; the defendants‚ duty "does not arise solely from the relationship between the parties." Hungerford, 143 N.H. at 211.  Where, as here, substantial social interests are imperiled by the failure to hold private investigators liable for their negligence toward the subjects of their investigations, the existence of a duty is even clearer.  See id.

In the course of their business, private investigators and information brokers regularly come into contact with intimately personal information concerning the subjects of their investigations. ^[1]   See Docusearch Home Page, at http://www.docusearch.com (last accessed July 18, 2002).  Due to their state-conferred rights and investigative skills and training--often obtained as police officers or detectives--these investigators have an almost unique ability to acquire such information.  See, e.g., New Hampshire League of Investigators Home Page, How to Hire an Investigator, at http://www.mv.com/ipusers/magee/ne.html (last accessed July 18, 2002) (noting that many investigators are former law enforcement officers or military personnel).

Additionally, through morally repugnant but common methods such as pretextual phone calls, private investigators uncover information that the subjects of investigations would not have otherwise disclosed.  (See Order of Certification at 6.)  It is left completely to the discretion of these investigators to judge the integrity of their client's intentions, to weigh the risk of harm to the subject of the investigation, and to decide based on their unique knowledge of their client and the nature of the request what information should or should not be handed over to him.  While many investigators surely exercise wise judgment, those who do not should not be free from liability for their negligence.

Societal well-being is significantly imperiled by the unaccountable release of such personal information by private investigators and information brokers.  Especially in today's information-based society, great harm can be done if personal information is misused.  Not withstanding the very real dangers of sharing personal information with potential stalkers or murderers, the epidemic of identity theft is a prime example of how such information could be misused.  The types of personal information implicated in this case, for instance, could be used to establish lines of credit, to apply for various services, and to secure employment; ruining the financial reputation of the victim.  See Statewide Grand Jury Report: Identity Theft in Florida, No. SC 01-1095 at 3 (Fla. 2002) (hereinafter „Identity Theft in Florida‰); see also Janice A. Alwin, Privacy Planning: Putting the Privacy Statutes to Work for You, 14 DePaul Bus. L.J. 353, 356-57 (2002) (describing the increase in identity theft in modern society).  Identity fraud „presents enormous public safety concerns‰ including the "emotional and frustrating task" of trying to clear the victims‚ good names.  See Identity Theft in Florida at 4.  Additionally, if people fear that unaccountable investigators could uncover and release their information--resulting in fraud or worse--they will be reluctant to participate in otherwise useful economic transactions.

B. Serious Risk of Physical and Economic Injury Is an Eminently Foreseeable Result of Disclosure by a Private Investigator of a Third Party‚s Personal Information.

The well-known dangers of unauthorized release of personal information, as well as the Defendants‚ own admissions of the menace posed by their clientele, reveal that the Defendants should have foreseen the likelihood of harm to Ms. Boyer based on the disclosure of the information to Mr. Youens.

The Defendants recognize the physical danger posed by many of their clients to the subjects of their investigations.  Defendant Cohn admitted that he attempted to verify that the purpose for which his clients sought information was lawful; Defendant Zeiss acknowledges vetting his clients in the same way.  (Plaintiff's Memorandum of Law in Support of Her Objection to "Docusearch Defendants," Motion for Summary Judgment at 15-16.)  Both are implicitly acknowledging that many of their clients seek information for illegal or harmful purposes, yet their only method of verifying their clients‚ intentions is simply asking for a verbal assurance of good intentions.  (Pl. Memo. at 16.)  Moreover, the Defendants explicitly mention "jealous ex-boyfriends" and harassers as the types of clientele they seek to avoid, which demonstrates their awareness that stalkers attempt to use their services.  (Pl. Memo. at 15-16.); accord Expert's Report of Robert Douglas at 2 (noting, as a private investigator himself, that services such as Docusearch inevitably attract stalkers like Mr. Yoens).

The release of personal information to the clients of private investigators without concern for the impact on the subjects of the investigations invites identity theft.  Identity theft is on the rise in the United States based on the increased availability of personal identifiers such as the Social Security Number.  Alwin, Privacy Planning at 357.  The Defendants are in the business of selling many of the types of information necessary to commit identity frauds: Social Security Numbers, addresses, and birth dates.  (See Order of Certification at 4-6.)

The dangers of disclosing such information are so great that many states are taking unprecedented action to provide consumers with necessary privacy safeguards.  In Florida, a recent statewide investigative grand jury recommended that new laws be passed preventing the sale or distribution of Social Security Numbers and other financial and personal information without the express consent of the owner.  Identity Theft in Florida at 33 (2002).  California and Georgia recently passed stringent new laws to help prevent and punish identity theft.  Cal. Penal Code §§ 530.5-530.7 (2002) (stating that Californians will be able to: request a "security alert" via a toll-free number when it is believed that credit or identity fraud has occurred, request a "security freeze" that prevents credit agencies from releasing personal information from an individual's credit report, stop"coercive disclosure" of the SSN, and prevent businesses from mailing forms with SSNs printed on them); Ga. Code Ann. §§ 16-9-121. 16-9-127 (2002) (stating that businesses can be fined up to $10,000 for the improper disposal of materials that contain personal information including SSNs about customers).  The frequency and regularity of these crimes belie Defendants‚ claim that they could not foresee any harm resulting from unauthorized disclosure of Ms. Boyer's personal information.

C. Private Investigators and Information Brokers Operate in a Largely Unregulated Industry with Insufficient Accountability for their Negligent Acts.

There unfortunately exists a healthy demand for the collection and sale of the personal information of others.  See Alwin, Privacy Planning at 353.  While many states regulate this industry through licensing requirements, qualifications, and statutory penalties for misuse of authority, other states have no or perfunctory licensing for private detectives, let alone for the nebulous category of"information brokers."  For example, compare New Hampshire, which requires that private investigators to maintain surety bonds, N.H. Rev. Stat. Ann. § 106-F:9 (2002), ^[2] and California, which requires applicants for licensure to submit to background checks, Cal. Bus. & Prof. Code § 7525.1 (2002), with Colorado and Mississippi, which apparently have no licensing procedures at all, 1999 Op. Miss. Att‚y Gen. LEXIS 289 (1999) (stating that no Mississippi statute requires a license to operate as a private investigator).

Because Internet sites can operate from anywhere, groups like Docusearch can take advantage of the lax licensing of the least-restrictive state yet provide services to anyone in the country. ^[3]   (See Order of Certification at 3.)  Even if every state increased their regulatory protections, these services could locate overseas.  The nebulous nature of the Internet means that victims of private investigators‚ negligence will rarely have recourse to legal remedies based on state licensing requirements.  That New Hampshire regulates the practices of this industry demonstrates the state's commitment to protecting victims like Ms. Boyer; without a tort remedy, however, negligent defendants could escape liability.

Absent tort remedies for negligent behavior on the part of private investigators and information brokers, third-party victims remain uncompensated for their losses.  While the criminal clients of private investigators should be the first targets of legal action to recover damages for the victims' losses, the investigators who negligently facilitate their stalking, identity fraud, and murder should not be free from liability.  Often, as in this case, the victim cannot recover her losses from the criminal directly and so remains uncompensated while the private investigators profit.  Tort remedies against private investigators allow the victims to pursue parties that contributed to the resulting harm, as well as provide incentive for Internet information broker operations like Docusearch to operate with basic standards of due care toward the subjects of their investigations.  Cf. Alwin, Privacy Planning at 354 (urging preventative solutions to identity theft and misuse of personal information).

II. An individual has a cause of action for intrusion upon seclusion against a private investigator or information broker who obtains a Social Security Number from a credit reporting agency and then sells it without permission to A third party.

A plaintiff who has her private information raided through conduct offensive to an ordinary person can sue for violation of the tort of intrusion upon seclusion.  Fisher v. Hooper, 143 N.H. 585, 590 (1999) (quoting Hamberger v. Eastman, 106 N.H. 107, 110 (1964)); see also Rest. 2d. of Torts § 652B (urging liability for unreasonable intrusion into another's "private affairs and concerns").  The Defendants' extraction of Ms. Boyer's Social Security Number in order to profit from its sale to her stalker is both an intrusion into her private affairs and unambiguously unreasonable conduct.

A. Because the Social Security Number Is One of the Most Valuable Pieces of Private Information Possessed by Individuals, It Deserves Adequate Protection.

The importance of Social Security Numbers (SSNs) has grown exponentially in recent years.  The SSN is used widely as an identifier and as a verification technique by both public and private entities.  Social Security: Gov‚t and Commercial Use of the Social Security Number is Widespread, Report to the Chairman, House Subcomm. on Social Security, Comm. on Ways and Means, 105th Cong. (1999) (report of the General Accounting Office).  Because each person‚s number is unique and the system is nationwide, use of the SSN has ballooned˜both for legal and illegal purposes.  Id.  Use of the number is required by many government agencies for purposes ranging from paying taxes to applying for food stamps.  Id. at 4-5.  Private firms often require SSNs when applying for checking accounts or home loans.  Id. at 5.  Courts have acknowledged that it is almost impossible for individuals to maintain the confidentiality of their SSNs--not because they do not want to, but because they cannot protect them adequately.  See Andrews v. TRW Inc., 225 F.3d 1063, 1067 (9th Cir. 2000), rev‚d on other grounds, 534 U.S. 19 (2001).

This widespread use and value of the SSN is predicated upon its uniqueness and personal nature, which means that each person has a substantial interest in keeping his number out of improper hands while at the same time being able to disclose it to those authorized to have it.  See Hearing on Protecting Privacy and Preventing Misuse of Social Security Numbers, Testimony Before the House Subcomm. on Social Security, Comm. on Ways and Means, 107th Cong. (2001) (statement of Marc Rotenberg, Executive Director, Electronic Privacy Information Center, and Adjunct Professor, Georgetown University Law Center), available at http://waysandmeans.house.gov/socsec/107cong/5-22-01/5-22rote.htm (arguing that there"is no other form of individual identification that plays a more significant role in record-linkage and no other form of personal identification that poses a greater risk to personal privacy").

In response to the dangers of unauthorized SSN disclosure and resulting public concern over the misuse of these numbers, several states and the federal government have recently enacted measures aimed at combating misuse.  Cal. Penal Code §§ 530.5-530.7 (2002); Ga. Code Ann. §§ 16-9-121. 16-9-127 (2002); Pub. L. No. 106-112, 113 Stat. 1338 (codified as amended at 15 U.S.C. §§ 6821-6827 (2002) and popularly known as the Gramm-Leach-Bliley Act).  Poll data suggests that Americans are overwhelmingly concerned about the distribution of their personal information in general and their SSNs in particular.  See "An Intimate Invasion," USA Weekend, July 2, 2000, at http://www.usaweekend.com/00_issues/000702/000702privacy.html (last accessed July 18, 2002) (reporting that over 80 percent of poll respondents felt that too many people had access to their credit records); The Odum Institute, Harris 1994 Privacy in the United States Survey, Study No. 943014, Louis Harris and Associates, Question B2a (1994) at http://www.irss.unc.edu/data_archive/pollsearch.html (last accessed July 18, 2002) (reporting that over 60 percent of respondents were concerned that their SSN would be used to harm or embarrass them).  Legislators have sought to address public concern by passing laws that limit use and disclosure of SSNs.  Cal. Penal Code §§ 530.5-530.7 (2002); Ga. Code Ann. §§ 16-9-121. 16-9-127 (2002); 15 U.S.C. §§ 6821-6827 (2002).  These legislative attempts demonstrate the need for adequate protection of the privacy interest inherent in the SSN.

Other courts have recognized the privacy interests inherent in the SSN, as well.  In State ex rel. Beacon Journal Publishing Co. v. City of Akron, the Ohio Supreme Court held that the "societal perception that SSNs should not be available to all," and found that that public perception of and federal legislation protecting the SSN was "sufficient to create an expectation of privacy" in the SSN.  640 N.E.2d 164, 168 (Ohio 1994).  Due to the dangers inherent in release of the SSN, the court found that disclosure of city employees' SSNs would be a violation of their constitutional right to privacy.  Id. at 169.  Similarly, in Greidinger v. Davis, the Fourth Circuit found that the privacy interest in Virginia voters' SSNs outweighed the state interest in disclosing them with voter rolls.  988 F.2d 1344, 1353-54 (4th Cir. 1993).  The court noted that:

[s]ince the passage of the Privacy Act, an individual‚s concern over his SSN's confidentiality and misuse has become significantly more compelling.  For example, armed with one's SSN, an unscrupulous individual could obtain a person's welfare benefits or Social Security benefits, order new checks at a new address on that person's checking account, obtain credit cards, or even obtain the person's paycheck.

Greidinger, 988 F.3d at 1353.  See generally Pub. L. No. 93-579, § 7, 88 Stat. 1896, 1909 (1974) (codified in 5 U.S.C. § 552a (1982) and popularly known as the Privacy Act of 1974) (requiring the federal government to protect the privacy of SSNs).

B. The Unauthorized Collection and Sale of the Victim's SSN to a Man who Had Publicly Stated His Intention to Track Her Down and Kill Her Is Conduct of the Most Offensive Nature.

The Defendants' actions concerning the collection and distribution of Ms. Boyer's SSN are truly despicable.  The Defendants failed to take reasonable steps to determine the use to which Mr. Youens planned to put the number.  (See Order of Certification at 4-5.)  Youens maintained an Internet site detailing his obsession with Ms. Boyer and his plans to murder her.  (Pl. Memo at 14.)  The phone calls from the Defendants to Mr. Youens were no more than a minute in duration--not enough time to adequately verify his purposes.  (See Order of Certification at 4-5.)  The Defendants did not perform any sort of background check upon Mr. Youens; indeed, by not inquiring into his background or asking him the purposes of his request, the Defendants seemed to have much more respect for the privacy of the killer than for the safety of Ms. Boyer.  (Order of Certification at 5.)

The Defendants knew they were handing over sensitive personal information--capable of being used to commit fraud or other bad acts--to a man about whom they knew nothing.  (Order of Certification at 5.)  The SSN is one of the key elements in the commission of identity theft, and yet the Defendants sold the number without bothering to determine if Mr. Youens wanted to use this information for any nefarious purpose.  (Order of Certification at 4-5). 

The Defendants essentially plundered Ms. Boyer's credit records in order to profit from the sale of her personal information.  This type of action is considered so vile that Congress was forced to take action to curb the sale of "credit headers," which include the SSN, without the permission of the individual.  See 15 U.S.C. §§ 6821-6827 (2002); Trans Union v. FTC, No. 01-5202 slip op. (D.C. Cir. 2002) (dismissing argument that restriction on sale of credit headers is a violation of the Free Speech Clause).  While the type of investigative services the Defendants engage is often appropriate, where investigators are indifferent to the welfare of the subject of their investigations, their conduct crosses the line from appropriate to objectively reprehensible.

III. PRIVATE INVESTIGATORS AND INFORMATION BROKERS INTRUDE UPON THE SECLUSION OF A VICTIM WHEN THEY USE DECEITFUL PRETEXTUAL PHONE CALLS TO EXTRACT HER WORK ADDRESS FOR SALE TO A CLIENT WHO INTENDS HER UNLAWFUL HARM.

If a victim has a reasonable belief that her personal information is private, or at least protected from those from whom she wishes to keep it, and the defendant goes "beyond the limits of decency" in obtaining that information, he has committed the tort of intrusion upon seclusion.  Fisher, 143 N.H.at 590.  Ms. Boyer had gone to some length to avoid publication of her work address; it took a deceitful pretext phone call from a person (hired by the Defendants) who pretended to be someone trustworthy to extract this information from her.  (Order of Certification at 6.)  The Defendants then sold this information to Mr. Youens to enable him to track down and kill Ms. Boyer.  This conduct seems the very definition of indecent.

A. Courts Regularly Hold Private Investigators and Others Liable for Privacy Violations When Their Investigations Go Beyond the Bounds of Common Decency Even When the Information Sought Is not „Secret.‰

Courts have consistently found that private investigators may be liable for intrusion upon seclusion.  See Clayton v. Richards, 47 S.W.3d 149, 154 (Tex. App. 2001) (holding that a private detective could be liable for privacy tort violations even when he only provided "technical assistance" to the actual intruder); Miller v. Brooks, 472 S.E.2d 350, 354 (N.C. Ct. App. 1996) (holding a private investigator liable for installing hidden cameras in the house of the plaintiff); Noble v. Sears, Roebuck & Co., 33 Cal. App. 3d 654, 657, 659 (1973) (holding an investigator liable for intrusion for using deception to get the plaintiff to reveal the address of a witness). 

Additionally, courts have held that the information uncovered need not be "secret" in the sense that no one other than the plaintiff has access to it; it is enough that the information is not for general dissemination and the conduct of the defendant is objectionable.  See Hogin v. Cottingham, 533 So. 2d 525, 531 (Ala. 1988) (noting that a parent may have a reasonable expectation of privacy in the names of their children); Noble, 33 Cal. App. 3d at 659 (finding that the plaintiff had a reasonable expectation of privacy in the address of her friend when the means of extraction of the information were so deceptive).

The work address of Ms. Boyer was a secret for purposes of the intrusion tort because she would not have disclosed the information to the Defendants had she been aware of their true identities.  The fact that the Defendants had to resort to pretext to trick Ms. Boyer into revealing the address is evidence of her intent to keep the information private.  (See Order of Certification at 4.)  This information was at least as private to Ms. Boyer as the child's name or the friend's address found to be secret by other courts applying this test.  See Hogin, 533 So. 2d at 531; Noble, 33 Cal. App. 3d at 659.

B. Using Deceitful Pretext Phone Calls to Trick a Victim Into Revealing Her Work Address for the Purpose of Selling It to a Murderous Stalker Is Offensive and Reprehensible Conduct.

The use of "pretexting" to uncover private information exceeds the limits of decency.  See Fischer, 143 N.H. at 590.  The practice has been widely criticized, and recent federal law limits the use of pretexting to obtain personal information from a financial institution.  See 15 U.S.C. §§ 6821-6827 (2002) (the Gramm-Leach-Bliley Act).  Though the information in the instant case obtained through pretest is not financial, the tactics used to obtain it are the same ones as those that prompted Congress to pass the Gramm-Leach-Bliley Act.  See id.

Not only did the Defendants use pretext to obtain the address, they then sold it to the one man in whose hands the information was most dangerous.  (See Order of Certification at 6.)  Mr. Youens then used the information to locate Ms. Boyer's office and execute his plan to kill her and himself.  (Order of Certification at 6.)  This type of violation of privacy seems precisely the type of fact scenario in which this Court felt the intrusion tort was appropriate.  See Fischer, 143 N.H.at 590 (concluding that it is "where the intrusion has gone beyond the limits of decency that liability accrues").

IV. AN INDIVIDUAL WHOSE SSN OR WORK ADDRESS IS SOLD BY A PRIVATE INVESTIGATOR OR INFORMATION BROKER HAS A CAUSE OF ACTION FOR COMMERCIAL APPROPRIATION AGAINST THE SELLER. 

Broadly defined, the tort of commercial appropriation protects the "inherent right of every human being to control the commercial use of his or her identity."  J. Thomas McCarthy, The Rights of Publicity and Privacy, § 1.2, 1-8 (1992).  According to the Restatement (Second) of Torts, "[o]ne who appropriates to his own use or benefit the name or likeness of another is subject to liability to the other for invasion of his privacy."  § 652C (1977).  For the purposes of this tort, an individual's  "name or likeness" is significant only as a manifestation of that individual's identity, and is only at issue when wrongfully used by another: "[i]t is the plaintiff"s name as a symbol of his identity that is involved here . . . . Unless there is some tortious use made of it, there is not such thing as an exclusive right to a name."  W. Page Keeton, ed. Prosser and Keeton on the Law of Torts, § 117, at 852 (5th ed. 1984).

A. Commercial Appropriation Should Be Expressly Recognized by this Court to Protect the Privacy Interests of Private Individuals In Their Personal Information.

The New Hampshire Supreme Court should not only recognize an express cause of action for commercial appropriation, but should extend this cause of action to private individuals whose personal information is gathered to create a "likeness" and sold without their consent by an information broker or private investigator.  The Restatement envisioned exactly the scenario presented here.  An illustration presented by the Restatement asserts that when a private detective seeks information regarding the relations of a client‚s wife with another man, and the private detective impersonates the wife to induce others to disclose information that they would not have otherwise disclosed, the private detective has committed commercial appropriation and invaded the wife's privacy.  Restatement (Second) of Torts, § 652C cmts. a-b, illus. 3.  Thus, both the Restatement (Second) of Torts and Professor Prosser assert that commercial appropriation does protect the privacy rights of private individuals.  This Court should explicitly state that this cause of action is available to private citizens of New Hampshire to protect their personal information from profiteering.

B. New Hampshire Should Join the Majority of States that Provide Commercial Appropriation Protection by Common Law or Statute.

Most states recognize that individuals need protection against the commercial appropriation of value inherent in their identities.  Currently, sixteen states recognize a common law cause of action for commercial appropriation of name, likeness, performance, or identity, and twelve other states have enacted comparable statutory protections instead of or in addition to recognizing the tort.  See Lake v. Wal-Mart, 582 N.W.2d 231 (Minn. 1998); 62A Am. Jur. 2d Privacy § 68 (2001); see also Alexander C. Giftos, Comment, The Common Law Right of Publicity and Commercial Appropriation of Celebrity Identity: "A Whole New Wardrobe for Vanna," 38 St. Louis L.J. 983 (1994) (listing Massachusetts as a state providing statutory protection against commercial appropriation.  See Mass. Ann. Laws ch. 214, § 1B (2002) (providing right of privacy)). 

The New Hampshire Supreme Court has the discretion to expressly extend a cause of action for commercial appropriation to its citizens.  It should exercise this discretion, and follow the lead of the numerous state supreme courts that provide a necessary remedy for their citizens.  In explaining its 1998 decision to adopt the tort of invasion of privacy, the Supreme Court of Minnesota stated:

[t]his court has the power to recognize and abolish common law doctrines.  The common law is not composed of firmly fixed rules.  Rather, as we have long recognized, the common law [] is the embodiment of broad and comprehensive unwritten principles, inspired by natural reason, an innate sense of justice, adopted by common consent for the regulation and government of the affairs of men.  It is the growth of ages, and an examination of many of its principles, as enunciated and discussed in the books, discloses a constant improvement and development in keeping with and advancing civilization and new conditions of society.  Its guiding star has always been the rule of right and wrong, and in this country its principles demonstrate that there is in fact, as well as in theory, a remedy for all wrongs.

Lake, 582 N.W.2d at 234 (quoting State ex rel. City of Minneapolis v. St. Paul, M.&M. Ry. Co., 108 N.W. 261, 268 (Minn. 1906), and Tuttle v. Buck, 119 N.W. 946, 947 (Minn. 1909)).  New Hampshire should ensure that there is a common law remedy for those who are injured when their personal information is wrongfully used for the economic gain of others.

C. New Hampshire Law Currently Provides No Legal Recourse For Private Individuals When They Sustain Injury as a Result of the Information Brokerage Industry‚s Collection and Use of Their Personal Information

A booming industry has sprung up around the brokering of personal information of private individuals.  In the current economy, "personal data is bought and sold in an open market much like tangible goods or securities."  Alwin, Privacy Planning at 353.  As a result, "consumers must treat their privacy like any other valuable asset and protect it at all costs."  Id.  Though courts have been slow to respond to privacy concerns raised by the information age, legal scholars have recognized for more than a decade that the law must evolve to protect the privacy interests of private individuals because their personal information has become increasingly easy to collect.  Hearing on the Need for Internet Privacy Legislation, Testimony Before the Senate Committee on Commerce, Science and Transportation, 107th Cong. (2001) (statement of Marc Rotenberg, Executive Director, Electronic Privacy Information Center, and Adjunct Professor, Georgetown University Law Center) at http://www.epic.org/privacy/internet/testimony_0701.html (last accessed July 18, 2002).  Advances in technology have „enhanced society‚s ability to collect, store, retrieve, process, and disseminate data on individuals, quite often without the individual‚s knowledge or consent.‰  Sandra Boyd Petersen, Note: Your Life as an Open Book: Has Technology Rendered Personal Privacy Obsolete?, 48 Fed. Comm. L.J. 163, 168 (1995).  Such technological developments may cause the privacy interests of public and private individuals to "collapse into a generalized protection against appropriation of personal characteristics for commercial advantage, regardless of traditional status awarded to those members of the professional sports and entertainment world."  Thomas E. Nielander and Don E. Tomlinson, Pardon Me But You Got My Best Bits: Misappropriation of Personal Characteristics and the New Age of Privacy and Publicity Rights in Digitally Manipulated Works, 20 Miss. C.L. Rev. 17, 25 (1999).

Private individuals are increasingly concerned about the general accessibility of their personal information.  According to a national survey, 96 percent of people consider it important to be in control of who can obtain information about them, and 95 percent believe it is important to be able to control what information is collected about them.  The Odum Institute, Harris Study No. 14875, Harris Interactive, Inc., Question Q705 (August 2001) at http://www.irss.unc.edu/data_archive/pollsearch.html (last accessed July 13, 2002).  In a more recent survey, 75 percent of respondents expressed concern that companies sell personal information to others without permission, and 89 percent felt that companies should not disclose personal information without permission or legal reason.  Electronic Information Center, Public Opinion on Privacy, Privacy On and Off the Internet: What Consumers Want, Harris Interactive, Inc. (2002), at http://www.epic.org/privacy/survey (last accessed July 13, 2002).  87 percent of respondents reported that they had declined to disclose personal information to a business because they felt the disclosure of such information was unnecessary or too personal.  Id.  69 percent expressed concern that their personal information can be stolen.  Id.  A March 2000 poll revealed that 57 percent of respondents favored the passage of laws to regulate how personal information is gathered and used.  Electronic Privacy Information Center, Public Opinion on Privacy, Business Week/Harris Poll: A Growing Threat, Business Week Magazine (2002), at http://www.epic.org/privacy/survey (last accessed July 13, 2002).  Another survey reported that 90 percent of respondents expressed a desire to control how personal information is used after collection.  Electronic Privacy Information Center, Public Opinion on Privacy, The Privacy Best Practice, Forrester Research (September 1999) in Forrester Technographics Finds Online Consumers Fearful of Privacy at http://www.epic.org/privacy/survey (last accessed July 13, 2002).  In yet another study, 60 percent of respondents expressed concern that another person or organization might use their Social Security Numbers to harm or embarrass them. The Odum Institute, Harris 1994 Privacy in the United States Survey, Study No. 943014, Louis Harris and Associates, Question B2a (1994) at http://www.irss.unc.edu/data_archive/pollsearch.html (last accessed July 13, 2002).

Despite the concerns shared by the vast majority of consumers, most individuals are unaware--and would likely be shocked to learn--of the extent to which personal information is collected and used by various private organizations during the course of everyday commerce.  Individuals‚ personal information may be of economic interest to physicians, employers, landlords, business organizations, insurance companies, and other private sources, in addition to private investigators and information brokers.  Petersen, Your Life, at 168.  Due to developments in technology, private individuals have little power over the collection and dissemination of vast amounts of personal information by and to these entities:

as technology becomes more sophisticated, it becomes easier to detail the lives of individuals˜their location at any given moment, what type of groceries they purchased, what books and magazines they read, where and with whom they travel, and whether they have ever sued a doctor or filed a worker‚s compensation claim.  Virtually every activity in every person‚s life will be recorded in the near future.

Id. 

This technological climate makes it nearly impossible for private individuals to function in modern society without imparting personal information, either knowingly or unknowingly.  To participate in day-to-day transactions, individuals have little choice but to divulge their SSNs, use non-cash payment methods such as credit cards or debit cards, and disclose personal information to various private sources.  Individuals often disclose this information unwittingly to sources that have no legal obligation to protect such information, which can subsequently be "gathered from many different sources, run through a computer, and assembled moments later into a complete and detailed personal dossier on virtually any individual."  Petersen, Your Life at 198.  Individuals have no legal control over this widespread collection and dissemination of personal information.  

This case demonstrates how this phenomenon causes specific harm even to a person who attempts to safeguard private information.  Evidence suggests that Ms. Boyer was conservative about revealing her personal information.  She chose not to display her SSN on her driver's license.  (Pl. Memo. at 3.)  Her name was not included in the household directory listing.  (Pl. Memo. at 3.)  She held few credit cards, and subscribed to only one or two magazines.  (Pl. Memo. at 3.)  However, Docusearch and Ms. Gambino compiled the personal information Ms. Boyer inevitably disclosed in day-to-day transactions without Ms. Boyer's knowledge or consent.  Mr. Youens was willing to pay for this information only because the data enabled him to track down Ms. Boyer.  Docusearch and Ms. Gambino sold this information for their own commercial profit, and Mr. Youens used Ms. Boyer's virtual likeness to inflict the gravest possible harm upon her.

Egregious business practices have rendered private individuals powerless against the private sector's collection of, dissemination of, and profit from personal information.   As a result, private individuals require a means to protect themselves against harm that results from the industry that has evolved around the gathering and sale of individuals‚ personal information.  For this reason, New Hampshire should recognize a cause of action for commercial appropriation, and should extend protection under this tort to private individuals whose personal information is sold for profit.

V. A PERSON WHOSE WORK ADDRESS IS OBTAINED BY A PRIVATE INVESTIGATOR OR INFORMATION BROKER BY MEANS OF A PRETEXTUAL TELEPHONE CALL HAS A CAUSE OF ACTION AGAINST THE PRIVATE INVESTIGATOR OR INFORMATION BROKER UNDER THE NEW HAMPSHIRE CONSUMER PROTECTION ACT.

The New Hampshire Consumer Protection Act protects individuals from „any unfair method of competition or any unfair or deceptive act or practice in the conduct of any trade or commerce within [New Hampshire].‰  N.H. Rev. Stat. Ann. § 358-A:2 (2002). ^[4]   The protections provided under this Act are not limited to the consumer in a transaction.  Eastern Mountain Platform Tennis v. Sherwin-Williams Co., 40 F.3d 492, 497 (1st Cir. 1994).    

A. The New Hampshire Consumer Protection Act Is Construed in Accordance With Federal Trade Commission Precedent.

New Hampshire courts pay great deference to Federal Trade Commission ("FTC") precedent when construing the New Hampshire Consumer Protection Act. For example, the New Hampshire Supreme Court has adopted FTC interpretations of whether conduct is unfair or deceptive, the hallmark standards of consumer protection law.  See Milford Lumber Co. v. RBC Realty, 147 N.H. 15, 19 (2001); Chroniak v. Golden Investment Corp., 983 F.2d 1140, 1146 (1st Cir. 1993); Gautschi v. Auto Body Discount Ctr., 139 N.H. 457 (1995); Roberts v. General Motors Corp., 138 N.H. 532 (1994); Rousseau v. Eshleman, 128 N.H. 564 (1986).  The New Hampshire Consumer Protection Act itself urges that "in any action or prosecution under this chapter, the courts may be guided by the interpretation and construction given . . . the Federal Trade Commission Act[,] by the Federal Trade Commission and the federal courts."  N.H. Rev. Stat. Ann. § 358-A:13 (2002).  The New Hampshire Supreme Court should therefore consider the FTC's position on pretextual phone calls intended to obtain personal information as they pertain to consumer protection law.

B. The Federal Trade Commission Has Vigorously Pursued Information Brokers Who Use Pretexting to Obtain Personal Financial Information.

The FTC has focused significant attention in the past several years upon consumer protection concerns stemming from greater availability of personal information in light of technological advances.  In 1997, the FTC "conducted and published a study of computer database services, known as look-up services or individual reference services, that make available personal identifying information used to locate and identify people." Obtaining Confidential Financial Information by Pretexting: Before the House Comm. on Banking and Financial Services, 106th Cong. (1998) (statement of the Federal Trade Commission) at http://www.ftc.gov/os/1998/9807/pretexttes.htm (last accessed July 14, 2002) (hereinafter "FTC Statement").  This analysis prompted the FTC to work with the computer databases service industry, which is a subset of the information brokering industry, to develop a self-regulatory program known as the "Individual Reference Services Group Principles" ("IRSG Principles") in 1998.  Id.  Thus, the FTC has recognized the consumer privacy concerns raised by the proliferation of technology, and the rise of the information brokering industry.

The FTC recognizes, however, that the IRSG Principles are of limited utility in combating the collection of personal information through fraudulent misrepresentation.  In the context of the computer databases service industry, the FTC maintains that pretexting is likely an unfair and deceptive practice within the meaning of consumer protection law:  "Although the Commission encourages industry self-regulation, the Commission is first and foremost a civil law enforcement agency, whose mandate is to combat unfair and deceptive practices.  And the practice of obtaining confidential information for resale under false pretenses appears to be just that˜unfair and deceptive."  Id. (emphasis added). 

The Gramm-Leach-Bliley Act made pretexting to obtain personal financial information from financial institutions illegal.  Pub. L. No. 106-112, 113 Stat. 1338 (codified as amended at 15 U.S.C. §§ 6821-6827 (2002)).  The FTC has energetically pursued violations of this law and, in April 2001, filed suit in three United States District Courts to stop information brokers from obtaining personal financial information through impersonation, false pretenses, or fraudulent statements.  Information Brokers Settle FTC Charges at http://www.ftc.gov/opa/2002/03/pretextingsettlements.htm (last accessed July 16, 2002). All three cases were settled in March 2002.  Id.  FTC Chairman Timothy J. Muris indicates that the FTC fully intends to continue prosecuting the pretexting of personal financial information. Timothy J. Muris, Protecting Consumers' Privacy: 2002 and Beyond, Remarks at the Privacy 2001 Conference (October 4, 2001) at http://www.ftc.gov/speeches/muris/privisp1002.htm (last accessed July 16, 2002).

C. The Policies Underlying the Federal Trade Commission‚s Stance Against the Pretexting of Personal Financial Information Apply Equally Well to the Pretexting of Other Types of Personal Information.

The FTC has not explicitly extended its anti-pretexting stance to information brokers who use pretextual phone calls to obtain non-financial personal information.  Nonetheless, the policy reasons behind prosecuting the pretexting of personal financial information apply to other types of sensitive personal information.

The FTC has determined that pretextual phone calls used to obtain financial information are probably unfair because such invasions are likely to cause "substantial injury" to consumers. FTC Statement.  Furthermore, consumers have no way of knowing that their personal information has been obtained and sold by an information broker, and so have no way to avoid the resulting injury.  Id.  This concern applies equally where pretexting is used to obtain other types of personal information. 

Personal information does not have to be financial to result in substantial injury to consumers when misused.  Ms. Boyer suffered grievous bodily injury at the hands of Mr. Youens as a result of Ms. Gambino's pretexting of Ms. Boyer"s work address.  (See Order of Certification at 6.)  Furthermore, Ms. Boyer could take no steps to protect herself against Mr. Youens because she had no way of knowing that Ms. Gambino had obtained the address under false pretenses, or that she had obtained the information for Docusearch, which would then sell it to Mr. Youens.  Ms. Boyer would never have given her work address to Ms. Gambino if she had known that Ms. Gambino was a private investigator or the true reason Ms. Gambino wanted this information.  For these reasons, this case demonstrates that the policies behind the FTC‚s prosecution of pretextual phone calls intended to obtain financial information apply also to pretextual phone calls intended to obtain other forms of personal information.

CONCLUSION

For the foregoing reasons, we ask that this Court find that: (1) under these facts, private investigators and information brokers have a legal duty to act with due care toward the subjects of their investigations; (2) a private investigator or information broker may be found liable for intrusion upon seclusion for obtaining and selling a third-party‚s Social Security Number without the consent or knowledge of the third-party; (3) a private investigator or information broker may be held liable for intrusion upon seclusion for using a pretextual phone call to obtain a third-party‚s work address for sale to their client; (4) commercial appropriation is a valid cause of action in New Hampshire, and a private investigator or information broker may be held liable under this cause of action for selling the personal information of a private individual without her knowledge or consent; and (5) a private investigator or information broker may be held liable under N.H. Rev. Stat. Ann. § 358-A for use of pretexting to obtain personal information.

Respectfully submitted,

THE ELECTRONIC PRIVACY INFORMATION CENTER

Date: July 19, 2002               

Chris J. Hoofnagle
D.C. Bar No. 463182

Marc S. Rotenberg
D.C. Bar. No. 422825

David L. Sobel
D.C. Bar No. 360418

Marcia Hofmann
Law Clerk

Will DeVries
Law Clerk

---

^[1] Docusearch claims to be "as intrusive as you need us to be, and will investigate the identity, reputation, conduct, affiliations, associations, movements, and whereabouts of just about anyone."  Further, they claim to be able to find "the listed, unlisted numbers of telephones, pagers, cellular phones and faxes, and even locate lost loves" an approach that surely appealed to Mr. Youens.  Docusearch Home Page.

^[2] N.H. Rev. Stat. Ann. § 106-F:9 (2002) states:

§ 106-F:9. Surety Bond.

The surety bond required by this section shall be so conditioned that the person bonded shall conduct his or her business in a lawful and honest manner without committing, compounding, aiding or abetting the commission of any criminal offense. Said bond shall be filed with and kept by the secretary of state and shall be subject to being sued upon by the attorney general of the state in the name of the state or sued upon by any person injured by a breach of any condition of such bond designed to protect such person. The principal sum of the bond shall be $50,000, which shall be increased by $50,000 for each additional type of license held by any person licensed under this chapter.

^[3] The main page of defendant's Internet site claims that Docusearch is America's premier provider of on-line investigative solutions, though Mr. Cohn is a licensed private investigator only in Florida.  Docusearch Home Page, at http://www.docusearch.com (emphasis added); (Order of Certification at 3).

^[4] New Hampshire Revised Statute § 358-A:2 provides in relevant part:

It shall be unlawful for any person to use any unfair method of competition or any unfair or deceptive act or practice in the conduct of any trade or commerce within this state. Such unfair method of competition or unfair or deceptive act or practice shall include, but is not limited to, the following:

I. Passing off goods or services as those of another;

II. Causing likelihood of confusion or of misunderstanding as to the source, sponsorship, approval, or certification of goods or services;

III. Causing likelihood of confusion or of misunderstanding as to affiliation, connection or association with, or certification by, another;

IV. Using deceptive representations or designations of geographic origin in connection with goods or services;

V. Representing that goods or services have sponsorship, approval, characteristics, ingredients, uses, benefits, or quantities that they do not have or that a person has a sponsorship, approval, status, affiliation, or connection that such person does not have[.]

RSA 358-A:2 (2002).