Privacy Policies And Partnerships In Conflict

There is a problem brewing in the Internet. From small sites to the biggest portals, the name of the game these days is partnerships and joint ventures. Getting lost in this hub of activity, however, is a growing conflict between the joint venture agreements commonly entered into among these participants and the privacy policies which govern the use of their sites.

Almost all sites, especially content and retail sites, have adopted privacy policies to ensure that customer information will be kept confidential. In fact, the strength of the privacy policy has been used as an enticement by these sites to get customers and users to trust them, and therefore to turn over more information about themselves. Essentially, those Web companies understand that their customers will only share important personal and demographic information so long as they know it will not be widely distributed. Typically, most of these sites include a statement within the privacy policy such as the following: "We will not sell or rent your personally identifiable information to anyone," See Yahoo Privacy Policy. "We employ other companies and individuals to perform functions on our behalf...they have access to personal information used to perform their functions, but may not use it for other purposes," See Amazon Privacy Policy. "We do not share or sell information that identifies our guests personally or makes it possible for other parties to contact them directly..." See Starbucks.com Privacy Policy. The basic tenet running through these statements is that a company will collect demographic and personal information but either will not share it with other entities (except subsidiaries) or, if it does share this information, will only share it in aggregate format, i.e., in a form where the individual users cannot be identified.

These types of privacy policies have given users the confidence to share personal information with Web sites and companies. However, over the last few months, there has been an increase in partnerships and joint ventures among Web based businesses, often with joint marketing agreements. In general, most of these agreements provide that there will be shared ownership of the information collected by the joint venturers or partners. While this may seem like a benign concept, in the context of privacy policies it appears that most joint venture agreements include prima facia violations of those policies. If the information is co-owned by two parties, one of the parties (presumably with a privacy policy that says they will not share information) will be giving the information to the other party. In other words, after enticing users to provide information with blanket statements that the private information would not be shared, the same sites enter into joint ventures, the very premise of which is to share the information.

Although it is not the intention of most Web partners to violate their privacy policies, it is only a matter of time before information which is shared among joint venturers will lead consumers or their advocates to claim that their privacy has been violated. Given the growing importance of Internet privacy concerns, this is a digital train wreck waiting to happen.

How to avoid the wreck? Companies need to compare their privacy policies with their proposed joint venture agreements and to make sure that they are in sync. This often is more difficult than it appears, since the privacy policy and the joint venture agreements are drafted by completely separate entities in the organization. Going forward, Web sites won’t be able to have it both ways: they either have to adopt a more lax privacy policy which will allow the sharing of information, or they need to stick with a strict policy which will restrict the flow of information under their joint venture agreements.