3

Let's say a private e-mail address used by a senior citizen (in WA) is provided to a company (also operating in WA). Assume the address is unique to the citizen's use of the company's services. No other company has been provided with the same e-mail address, with the intent of identifying sources of abuse.

Later, the senior citizen begins receiving an increasing stream of messages that appear to be targeted phishing because they are addressed to the special address given only to the one company.

Would negligent release of PII be a cause of action if causes a senior citizen to be subject to a series of attempted financial fraud?

Assume Washington State law might apply. I've read the WA elder abuse law are stronger than the average. Would actual financial loss through a scam be required to succeed in pressing this matter?

Improve this question
7
  • 1
    How does said person prove it is not just a random matchup of "First Name Last Name @ Provider" that fits his mail address and instead a leak of the company? Fraud, even attempted one, needs to be plead with particularity. Like, I would understand if "[email protected]" would be particularly unique and wouldn't be a randomly made mail address, but [email protected] can be made by any random software combo that holds the words John and Smith as first/last names and the (non existant) mail provider domain as valid.
    – Trish
    Oct 10, 2021 at 21:34
  • @Trish I assume that falls under "Assume the address is unique to the citizen's use of the company's services." The question asks us to assume the victim can establish that their address was leaked by the company and asks how the law applies to that set of facts.
    – cpast
    Oct 10, 2021 at 23:07
  • @cpast It is trivial to write a program that makes any combination of normal names as they are used in emails, which are usually used. Random character e-mails however are generally not used because people can't remember them, which makes spammers not use such generated e-mails. But even those get spam where the mail address was generated randomly. And even some e-mail providers or your browser can be used to leak e-mail addresses.
    – Trish
    Oct 11, 2021 at 0:25
  • 1
    Which U.S. law?
    – ohwilleke
    Nov 10, 2021 at 22:57
  • 1
    Good question @ohwilleke, in Washington state, RCW 19.255.010 <apps.leg.wa.gov/RCW/default.aspx?cite=19.255.010>
    – Burt_Harris
    Jul 8, 2022 at 20:54

1 Answer 1

Reset to default
-2

The causal link between the existence of spam and how the email address is used is going to be the tenuous part of the argument. Virtually all email addresses receive a certain amount of spam so who is to say that the fact that the email is used for work is the reason for increased spam, the spam could just as easily originated from a business card that the old person handed out.

I do think that the hypothetical is highly unlikely to ever happen as it is an exceptionally poor business practice to allow a person to use a personal email address for business purposes. Any business worth its salt would only allow employees to use a business email address that the business owns and controls.

Improve this answer
5
  • The person is a customer, not an employee. I had to read the question three or four times before I worked that out.
    – phoog
    Oct 11, 2021 at 17:15
  • 2
    The way I read it is the senior citizen gives out unique addresses to every company they deal with. If you own a domain, you can give out email address as [email protected] for every company you deal with. Therefore one can be certain that spam to company-name@ came from a data leak from company.
    – Dave
    Nov 10, 2021 at 13:28
  • 1. The question states "Assume the address is unique to the citizen's use of the company's services.", while your answer assumes that was handed to other parties. 2. Your answer talks about using a personal address for business purposes being uncommon. But the question is simply talking about a user/customer of the company handing it their personal email address. That's the typical case when signing up with a B2C company.
    – CodesInChaos
    Mar 11, 2022 at 12:20
  • If one keeps your email logs, it should be easy to show that one had sent emails with that address only to one company. That would be strong evidence that the data release came from that company.
    – User65535
    Jul 8, 2022 at 13:32
  • @User65535: Companies don't typically acquire e-mail address PII by receiving an e-mail, but rather by asking for it on a web form.
    – Burt_Harris
    Jul 8, 2022 at 20:59

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .