Let's say a private e-mail address used by a senior citizen (in WA) is provided to a company (also operating in WA). Assume the address is unique to the citizen's use of the company's services. No other company has been provided with the same e-mail address, with the intent of identifying sources of abuse.

Later, the senior citizen begins receiving an increasing stream of messages that appear to be targeted phishing because they are addressed to the special address given only to the one company.

Would negligent release of PII be a cause of action if causes a senior citizen to be subject to a series of attempted financial fraud?

Assume Washington State law might apply. I've read the WA elder abuse law are stronger than the average. Would actual financial loss through a scam be required to succeed in pressing this matter?

  • 1
    How does said person prove it is not just a random matchup of "First Name Last Name @ Provider" that fits his mail address and instead a leak of the company? Fraud, even attempted one, needs to be plead with particularity. Like, I would understand if "ljgdawrzip@whatever.me" would be particularly unique and wouldn't be a randomly made mail address, but JohnSmith@randomemailprovider.notmail can be made by any random software combo that holds the words John and Smith as first/last names and the (non existant) mail provider domain as valid.
    – Trish
    Oct 10 at 21:34
  • @Trish I assume that falls under "Assume the address is unique to the citizen's use of the company's services." The question asks us to assume the victim can establish that their address was leaked by the company and asks how the law applies to that set of facts.
    – cpast
    Oct 10 at 23:07
  • @cpast It is trivial to write a program that makes any combination of normal names as they are used in emails, which are usually used. Random character e-mails however are generally not used because people can't remember them, which makes spammers not use such generated e-mails. But even those get spam where the mail address was generated randomly. And even some e-mail providers or your browser can be used to leak e-mail addresses.
    – Trish
    Oct 11 at 0:25
  • @Trish As far as I can tell, you're the one who came up with the idea that the email address would be first.last@provider. The question doesn't say that. You're assuming that the email address isn't some random combination of characters because "people can't remember them," which again is a rule you created (and the question specifically says "this isn't the person's real email and was created specifically to use with this one service"). Don't invent your own conditions and use them to "prove" that a hypothetical doesn't work.
    – cpast
    Oct 11 at 2:03
  • @Trish, simple, just assume the address isn't of the form you described. Right on cpast Oct 11 at 2:05

The causal link between the existence of spam and how the email address is used is going to be the tenuous part of the argument. Virtually all email addresses receive a certain amount of spam so who is to say that the fact that the email is used for work is the reason for increased spam, the spam could just as easily originated from a business card that the old person handed out.

I do think that the hypothetical is highly unlikely to ever happen as it is an exceptionally poor business practice to allow a person to use a personal email address for business purposes. Any business worth its salt would only allow employees to use a business email address that the business owns and controls.

  • The person is a customer, not an employee. I had to read the question three or four times before I worked that out.
    – phoog
    Oct 11 at 17:15
  • 1
    The way I read it is the senior citizen gives out unique addresses to every company they deal with. If you own a domain, you can give out email address as company-name@my-domain.tld for every company you deal with. Therefore one can be certain that spam to company-name@ came from a data leak from company.
    – Dave
    Nov 10 at 13:28

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.