LOTUS program possible privacy violation L---T+---T----T----T----T----T----T----T----T----

LOTUS program possible privacy violation L---T+---T----T----T----T----T----T----T----T----T----T----T----T----R RE: Personal Privacy Violations This was forwarded out of EGGNET but has implications that I thought everyone should read: The following are texts of messages which have made there way to me. This might affect you so I am forwarding the information to you. //////////////////////////////////////////////////////////////////// I just received this morning and thought I should pass this on to you all. This could seriously impact future employment/salary considerations if this service is sold as described below. Please read the whole memo before drawing your conclusions. Also, if you plan to take any action, I would suggest also calling your elected government officials. Also, you may want to pass this on. //////////////////////////////////////////////////////////////////// I just call Lotus and the message below is correct. If you want to be remove from the CDROM list you can call LOTUS at : 800-225-5800 or 800-343-5414 or 617-577-8500 And ask for Pre-sales Department. The Product name is LOTUS MARKETPLACE. They will send you a postcard to fill out and send in. Otherwise you could write to: Lotus Development Corp. Atten: Market Name Removal Service 55 Cambridge Parkway Cambrige, Ma. 02139 ////////////////////////////////////////////////////////////////// Folks, I recently forwarded a message about a new Lotus product -- a database on CDROM of 120M US residents with their estimated incomes and buying profiles. Someone questioned whether Lotus is really doing this, so I checked by calling Lotus and speaking to someone in pre-sales service. It really is true. Lotus is still gearing up to sell their "Household Marketplace" product, and it really does give information on individual people, not just regional statistical summaries. I learned the following (and I asked for literature, so I'll soon know even more): 1) Yes, it really *DOES* have names and addresses of individuals. 2) They have divided up the database by regions, and you specify the region you are interested in when you buy the product. That explains how they could have 120M people in their database and still sell you just 1 CD (or a few) for your purchase price. 3) They also have a "Business Marketplace" CD with data on 7 million US businesses. I forebore yelling at the sales-type who handled my call, merely asking if there was a place to write with comments about the service. Apparently the sales types haven't heard of the controversy the product is raising, since she replied that several different reports can be generated by the product, and some of them do have space for comments. GREAT! So not only do they have the audacity to print an estimate of your income (which could be quite damaging if they get it wrong, and is an intrusion into your privacy if they get it right), they also have space on the disk for arbitrary comments about you -- and they'll be selling this data in volume to mass marketing companies across the country! In interviews, Lotus has said that individuals will NOT be able to correct their own entries, or even see what they are. I didn't try to confirm this in my call to Lotus, but I did confirm that the person who reported it -- Rich Salz of BBN -- has an excellent reputation on the internet. Also, everything he said that I checked with Lotus is absolutely accurate. Further, the Wall Street Journal has reported on it -- saying that the database has ages, marital status, and other such personal data as well. So I believe it, and you should to, since it is going to affect your life. Remember -- a database of 120 million US residents comes to almost half the people in the country. Considering that the database is probably biased toward those with higher incomes, the chances are *really good* that anyone able to electronically read this message is in the database. What can you do about it? A couple of things. Lotus has said that they'll omit from their database anyone who asks. Therefore, start by writing to the address below. Tell them that you don't want to be in the database, and tell them exactly what you think of their database. I've appended a copy of my letter to Lotus for an example. Second, pass this message along to anyone whom you think might care. To me, this is not just a matter of privacy. Lotus is going to sell information behind our backs -- we are not allowed to dispute their data or even know what it is. Worse, Lotus is going to sell rumors about our income. Still worse, they will do it on a scale never before achieved. This should not be tolerated. Please help to stop Lotus. //////////////////////////////////////////////////////////////////// Write to: Lotus Development Corp. Attn: Market Name Referral Service 55 Cambridge Parkway Cambridge, MA 02142 //////////////////////////////////////////////////////////////////// Here's my letter. Also send copies of your letter to the president and the CEO of Lotus, if you want to let those at the highest levels know that you are displeased with their product. I've also appended a net copy of the Wall Street Journal artical about it. Lotus Development Corp. Attn: Market Name Referral Service 55 Cambridge Parkway Cambridge, MA 02142 Dear Marketeers, I do not want my name included in your "Household Marketplace" CDROM database, nor that of anyone in my family, at any address I have ever lived at. To be specific, please make sure that the following entries are **NOT** included in your database: any at As you have it set up, I think your "Household Marketplace" CDROM database is an incredible intrusion and ought to be illegal. I am a computer professional, so this opinion is not based on any native dislike of computers or databases. The problems I have with your proposed service involve the way in which you plan to administer it, the way in which the data will almost certainly be used, the type of data you are including, and my conviction that you will vigorously seek to avoid responsibility for errors in your database. First, administration. I have heard that you are not providing any means to correct errors in your database. The potential for long term damage to individuals from use of your database is therefore enormous. Even if an individual knows that your database is false, users of your database will almost certainly believe the CDROM data in spite of any disclaimers or evidence offered by the individual. Second, use of data. Given the fact that law enforcement agencies are nearly powerless to shut down obviously illegal boiler-room businesses, it is absurd for you to claim that you will only provide the data to legitimate businesses. You won't be able to prevent your product from being used to defraud individuals by huge numbers of illegal operations. One way or another, essentially any business who wants your database will be able to get it -- and it will be of special value to illegal and borderline businesses. Third, type of data. I understand that you plan to publish "income estimates". There is no legal way for you to verify income, unless an individual voluntarily provides that information. (I never do, except when the data is legally required to be held in confidence.) It is absolutely unacceptable for you to publish what amount to rumors about people's income. The possibilities for abuse are tremendous. Fourth, responsibility. I understand that you will not permit individuals to find out what information you are spreading about them. The only likely reason for this is that you don't want anyone to find out that your information about them is false. Therefore, while you will sell this product on the basis of providing reliable information, you aren't prepared to be responsible for the accuracy of your information, or for the damage that false information (or even true information) might cause. So as you see, my concerns about your product are not primarily about privacy, although privacy is involved. If you were prepared to take responsibility for the accuracy of your information, then I would be willing to accept your service. For example, you could send copies of the data entries to *each* individual in your database, with a request to write back if any of the data is incorrect or if they want to be removed from your listing. If you did this, and *made* the requested corrections, then I would feel that you were providing a positive service, rather than making abusive use of unverified data. In conclusion, if you market this product, it is my sincere hope that you are sued by every person for whom your data is false, with the eventual result that your company goes bankrupt. That would be a pity, since you make many fine products. However, that is preferable to permitting you to spread rumors and encourage abusive business practices. It would be better if your chief officers went to jail, but that will apparently require new laws to be passed. If you persist in your plans to market this product, a lot of people will be pushing to make that happen. I suggest that you abandon this project while there is time to do so. Yours most sincerely, ///////////////////////////////////////////////////////////////////// Lotus - New program spurs fears privacy could be undermined {The Wall Street Journal, 13-Nov-90, p. B1} Privacy advocates are raising the alarm about a new Lotus product that lists names, addresses, shopping habits and likely income levels for some 80 million U.S. households. Due for release early next year, Lotus Marketplace packs the data on palm-sized compact disks aimed at small and mid-sized businesses that want to do inexpensive, targeted direct-mail marketing. But critics say the product is just too good. "It's going to change the whole ball game," says Mary Culnan, an associate professor at Georgetown University's School of Business Administration. "This is a big step toward people completely losing control of how, and by whom, personal information is used." Janlori Goldman, a staff attorney with the American Civil Liberties Union, adds that the product raises "serious legal and ethical questions." Lotus' critics concede that the product offers little more than is already available from established mailing-list brokers. But they say it is a greater potential threat to personal privacy because of its low cost, ease of use and lack of effective safeguards over who ultimately has access to it and why. They also say that the way it is designed allows users to ask a series of increasingly specific questions about small subgroups of people - identifying, for example, unmarried, wealthy women over 65 in a neighborhood. "They've crossed the line," says Marc Rotenberg, Washington director for the nonprofit Computer Professionals for Social Responsibility. "It simply shouldn't be allowed on the market." Lotus counters that the product, still under development, has been tailored to address privacy concerns. No phone numbers will be included, it won't be available in retail stores and it will be sold only to "legitimate businesses" at verified addresses checked against a "fraud file," Lotus says. A contract will specifically limit its use and provide penalties for abuses. Owners will be be allowed unlimited use of the names and addresses they buy, at a cost of $695 initially for the program plus 5,000 names and $400 for each additional 5,000 names.