Business sending personal info to a random email address

Question

Is there a recourse against a business sending personal information of a customer to a wrong email address?

For example, if I provide a correct email address to the business through an online form, but, (1), their representative cuts out a significant part of the username, or, (2), their systems somehow mangle it, in a reproducible fashion such that the resulting address is still valid and belongs to someone else.

What if they send the full name and credit-card/billing/shipping addresses, and possibly some credit card details relating to an order, to such a random email address, what recourse does the customer has against such a business?

What if the business refuses to correct email address, claiming that the order has already been made? Would that be an extra count of negligence if they continue mailing information to such a wrong email address?

Answer 1

I am not a lawyer, I am not your lawyer.

You do not identify a jurisdiction and the answer will turn almost entirely on this. As an Australian I will deal with that jurisdiction.

Privacy Law

The Privacy Act 1988 governs personal information of or an opinion of an identifiable individual collected and held by Australian Government Agencies and businesses with a turnover of more than $3 million. See http://www.oaic.gov.au/. States and territories have similar legislation that fills some of the gaps.

Under that legislation you have a number of rights, the most applicable to your circumstances being:

• the right to have your information corrected
• the right to complain

On the face of it the actions taken would be in breach of the legislation if committed by an entity covered. It is worth noting that if your name and address are published (say in the phone book) then they are not personal information; credit card details would be personal information.

Consumer Law

There may be a breach here - it would depend on the exact law in the jurisdiction.

Common Law

In order to establish negligence as a Cause of Action under the law of torts, a plaintiff must prove that the defendant:

1. had a duty to the plaintiff,
2. breached that duty by failing to conform to the required standard of conduct (generally the standard of a reasonable person),
3. the negligent conduct was, in law, the cause of the harm to the plaintiff, and
4. the plaintiff was, in fact, harmed or damaged.

Where a case would fall over is on point 4.; what harm, in the sense of an actual loss, have you suffered? I can't see that you have actually suffered any damage. If you were to suffer credit card fraud or identity theft and you could prove that the company was the source of the information you would have a case for the loss.

You could seek an order of the court to make them correct their records