privacy negligence
Business sending personal info to a random email address
<p>Is there a recourse against a business sending personal information of a customer to a wrong email address?</p>

<p>For example, if I provide a correct email address to the business through an online form, but, (1), their representative cuts out a significant part of the username, or, (2), their systems somehow mangle it, in a reproducible fashion such that the resulting address is still valid and belongs to someone else.</p>

<p>What if they send the full name and credit-card/billing/shipping addresses, and possibly some credit card details relating to an order, to such a random email address, what recourse does the customer has against such a business?</p>

<p>What if the business refuses to correct email address, claiming that the order has already been made?  Would that be an extra count of negligence if they continue mailing information to such a wrong email address?</p>

<p>I am not a lawyer, I am not your lawyer.</p>

<p>You do not identify a jurisdiction and the answer will turn almost entirely on this. As an Australian I will deal with that jurisdiction.</p>

<p><strong>Privacy Law</strong></p>

<p>The <em>Privacy Act 1988</em> governs <strong>personal</strong> information of or an <strong>opinion</strong> of an identifiable <strong>individual</strong> collected and held by Australian Government Agencies and businesses with a turnover of more than $3 million. See <a href="http://www.oaic.gov.au/" rel="nofollow">http://www.oaic.gov.au/</a>. States and territories have similar legislation that fills some of the gaps.</p>

<p>Under that legislation you have a number of rights, the most applicable to your circumstances being:</p>

<ul>
<li>the right to have your information corrected</li>
<li>the right to complain </li>
</ul>

<p>On the face of it the actions taken would be in breach of the legislation <strong>if</strong> committed by an entity covered. It is worth noting that if your name and address are <em>published</em> (say in the phone book) then they are not personal information; credit card details would be personal information.</p>

<p><strong>Consumer Law</strong></p>

<p>There may be a breach here - it would depend on the exact law in the jurisdiction.</p>

<p><strong>Common Law</strong></p>

<p>In order to establish negligence as a Cause of Action under the law of torts, a plaintiff must prove that the defendant:</p>

<ol>
<li>had a duty to the plaintiff,</li>
<li>breached that duty by failing to conform to the required standard of conduct (generally the standard of a reasonable person),</li>
<li>the negligent conduct was, in law, the cause of the harm to the plaintiff, and</li>
<li>the plaintiff was, in fact, harmed or damaged.</li>
</ol>

<p>Where a case would fall over is on point 4.; what harm, in the sense of an actual loss, have you suffered? I can't see that you have actually suffered any damage. If you were to suffer credit card fraud or identity theft and you could <em>prove</em> that the company was the source of the information you would have a case for the loss.</p>

<p>You could seek an order of the court to make them correct their records</p>
