There has been much debate about the feasibility of providing adaquate legal protection for consumer privacy in the Information Age. Here is the text of a computer records privacy act that is actually on the books. It is part of Title 18, the United States Criminal Code. While not perfect, see for example (b)(2)(D)(ii), it suggests what might be possible. Text in the law that identifies the type of organization whose records are protected has been deleted. Can you guess what is actually covered?
Hint: It is a type of organization whose records Congressman were extremely concerned about keeping private. Could it be:
A link to the correct answer is at the end of this page.
United States Code Title 18 Sec. 2710. Wrongful disclosure of [XYZ] records * (a) Definitions. - [XYZ clues deleted] * (b) [XYZ] Records. - (1) A[n] [XYZ] provider who knowingly discloses, to any person, personally identifiable information concerning any consumer of such provider shall be liable to the aggrieved person for the relief provided in subsection (d). o (2) A [XYZ] provider may disclose personally identifiable information concerning any consumer - + (A) to the consumer; + (B) to any person with the informed, written consent of the consumer given at the time the disclosure is sought; + (C) to a law enforcement agency pursuant to a warrant issued under the Federal Rules of Criminal Procedure, an equivalent State warrant, a grand jury subpoena, or a court order; + (D) to any person if the disclosure is solely of the names and addresses of consumers and if - + (i) the [XYZ] provider has provided the consumer with the opportunity, in a clear and conspicuous manner, to prohibit such disclosure; and (ii) the disclosure does not identify the [XYZ content of the] material; however, the subject matter of such materials may be disclosed if the disclosure is for the exclusive use of marketing goods and services directly to the consumer; + (E) to any person if the disclosure is incident to the ordinary course of business of the [XYZ] provider; or + (F) pursuant to a court order, in a civil proceeding upon a showing of compelling need for the information that cannot be accommodated by any other means, if - + (i) the consumer is given reasonable notice, by the person seeking the disclosure, of the court proceeding relevant to the issuance of the court order; and (ii) the consumer is afforded the opportunity to appear and contest the claim of the person seeking the disclosure. If an order is granted pursuant to subparagraph (C) or (F), the court shall impose appropriate safeguards against unauthorized disclosure. o (3) Court orders authorizing disclosure under subparagraph (C) shall issue only with prior notice to the consumer and only if the law enforcement agency shows that there is probable cause to believe that the records or other information sought are relevant to a legitimate law enforcement inquiry. In the case of a State government authority, such a court order shall not issue if prohibited by the law of such State. A court issuing an order pursuant to this section, on a motion made promptly by the [XYZ] provider, may quash or modify such order if the information or records requested are unreasonably voluminous in nature or if compliance with such order otherwise would cause an unreasonable burden on such provider. * (c) Civil Action. - (1) Any person aggrieved by any act of a person in violation of this section may bring a civil action in a United States district court. o (2) The court may award - + (A) actual damages but not less than liquidated damages in an amount of $2,500; + (B) punitive damages; + (C) reasonable attorneys' fees and other litigation costs reasonably incurred; and (D) such other preliminary and equitable relief as the court determines to be appropriate. o (3) No action may be brought under this subsection unless such action is begun within 2 years from the date of the act complained of or the date of discovery. o (4) No liability shall result from lawful disclosure permitted by this section. * (d) Personally Identifiable Information. - Personally identifiable information obtained in any manner other than as provided in this section shall not be received in evidence in any trial, hearing, arbitration, or other proceeding in or before any court, grand jury, department, officer, agency, regulatory body, legislative committee, or other authority of the United States, a State, or a political subdivision of a State. * (e) Destruction of Old Records. - A person subject to this section shall destroy personally identifiable information as soon as practicable, but no later than one year from the date the information is no longer necessary for the purpose for which it was collected and there are no pending requests or orders for access to such information under subsection (b)(2) or (c)(2) or pursuant to a court order. * (f) Preemption. - The provisions of this section preempt only the provisions of State or local law that require disclosure prohibited by this section.
[from US Code as of: 01/23/00]
Here is a link to the full text of this law. Read it and be amazed.