Spitzer Alleges Firm Sold Personal Information From Millions of Customers

New York Attorney General Eliot Spitzer on Thursday sued a Washington, D.C., company for allegedly selling the personal information of millions of consumers. Prosecutors called it the largest deliberate breach of privacy in Internet history.

Gratis Internet Inc. and its owners Peter Martin and Robert Jewell were named in the suit filed in New York State Supreme Court. The defendants are accused of selling lists of millions of Gratis customers to three independent email marketers, despite explicit promises that no personal information would be given to anyone. The suit seeks a court injunction preventing the company from further sales, and seeks penalties under New York's consumer fraud statutes.

The suit stems from an investigation Spitzer launched last year of companies involved in the compilation and sale of marketing lists. Gratis collected customer information on several of its Web sites in exchange for free products, generally received through free trials of other products. The Gratis sites included FreeiPods.com, FreeCDs.com, FreeDVDs.com and FreeVideoGame.com.

From 2000 to 2004, Gratis posted on its Web sites several statements claiming to protect personal information, including one that said, "We well never give out, sell, or lend your name or information to anyone," Spitzer said.

Nevertheless, during 2004 and 2005, Martin and Jewell repeatedly violated those promises by selling customer lists to marketers, who then sent hundreds of millions of email solicitations on behalf of their own cutomers, Spitzer said. In each deal, Gratis shared between 1 million and 7 million confidential user records."This is believed to be the largest deliberate breach of a privacy policy ever discovered by U.S. law enforcement," Spitzer said in a statement.

The suit also alleges that Gratis falsely denied such data sharing had occurred. In a written response to Spitzer's investigation, Gratis claimed that "at all times during its existence . . . Gratis has never sold, rented, or lent email addresses or personal information of its users to any third-party and the company has always maintained control over and ownership of such information."

In the suit, Spitzer cites specific data-sharing contracts, as well as testimony and other evidence provided by Internet marketers that did business with Gratis.

Privacy advocates quoted in Spitzer's statement announcing the suit, praised the actions by the attorney general.

"Without strong enforcement, privacy policies are meaningless," Marc Rotenberg, the executive director of the Electronic Privacy Information Center in Washington D.C., said.Beth Givens, director of the Privacy Rights Clearinghouse, said the suit sends the message that "Deception doesn't pay."