Remsburg v. Docusearch, Inc.
149 N.H. 148 (2003)
Premium Feature
Subscribe to Lexplug to listen to the Case Podcast.
Rule of Law:
An information broker owes a duty of reasonable care to a third party whose personal information it sells because the risk of criminal misuse of that information, such as stalking or identity theft, is foreseeable.
Facts:
- New Hampshire resident Liam Youens contacted Docusearch, an internet-based information service, to obtain personal information about another resident, Amy Lynn Boyer.
- Youens first purchased Boyer's date of birth and later her Social Security Number (SSN) from Docusearch.
- Docusearch obtained Boyer's SSN from a credit reporting agency as part of a 'credit header' without her knowledge or permission.
- Youens then placed an order for Boyer's employment information.
- A subcontractor for Docusearch, Michele Gambino, obtained Boyer's work address by placing a 'pretext' telephone call to Boyer, in which Gambino lied about her identity and purpose.
- Docusearch sold the work address it obtained to Youens.
- On October 15, 1999, Youens drove to Boyer’s workplace, fatally shot her as she was leaving, and then killed himself.
- A police investigation revealed Youens maintained a website that contained references to stalking and killing Boyer.
Procedural Posture:
- The case was initiated in the United States District Court for the District of New Hampshire, presumably by Amy Boyer's estate against Docusearch, Inc.
- The U.S. District Court determined that the case involved unresolved questions of New Hampshire state law.
- Pursuant to Supreme Court Rule 34, the U.S. District Court certified five questions of law to the New Hampshire Supreme Court for resolution.
Premium Content
Subscribe to Lexplug to view the complete brief
You're viewing a preview with Rule of Law, Facts, and Procedural Posture
Issue:
Under New Hampshire common law, does an information broker who sells a third party's personal information to a client owe a legal duty of care to that third party to protect them from foreseeable harm?
Opinions:
Majority - Dalianís, J.
Yes. An information broker who sells a third party's personal information to a client owes a legal duty to exercise reasonable care to protect that third party from foreseeable harm. The court reasoned that while a person generally has no duty to protect others from the criminal acts of third parties, an exception exists when one's own affirmative conduct creates a foreseeable risk of harm. The threats posed by stalking and identity theft are sufficiently foreseeable consequences of selling personal information that they create a duty of care, especially when the seller does not know the client or their purpose. Further, the court determined that: (1) selling a person's SSN may constitute an intrusion upon seclusion because there is a reasonable expectation of privacy in one's SSN, but selling a public work address does not; (2) selling personal information for its intrinsic data value does not constitute the tort of commercial appropriation, which protects the value of a person's reputation or likeness; and (3) obtaining information via a pretextual phone call is a deceptive practice for which the deceived party can sue under the state's Consumer Protection Act, even without privity of contract.
Analysis:
This decision establishes a significant new common law duty for information brokers in New Hampshire, holding them accountable for the foreseeable consequences of their business. It adapts traditional tort principles to the realities of the digital age, recognizing that the sale of personal data creates tangible risks of physical harm and financial fraud. The ruling expands liability beyond the direct parties of a transaction, allowing victims of data misuse to sue the providers of that data. By distinguishing between the privacy expectations for an SSN versus a work address, the court also provides a framework for analyzing future data privacy claims under the tort of intrusion upon seclusion.
Unlock the full brief for Remsburg v. Docusearch, Inc.