Brody's Notes... FTC Warns Defunct Magazine/Website That Sale Of Subscriber Info Would Be Unlawful

By Brody Levesque (Washington DC) July 13 | In a July 1st letter to the principals, [ via the law firm representing them in federal bankruptcy court ] of the now defunct XY magazine & website, the Director of the Federal Trade Commission's Bureau of Consumer Protection, David Vladeck, warned that: 

"Based on the information currently available to us, [ FTC-BOCP ] we believe that any sale, transfer, or use of the XY PI [ Personal Info ] raises serious privacy issues and could violate the FTC Act. Further, to avoid the possibility that this highly sensitive data could fall into the wrong hands, we ask that it be destroyed ( along with any credit card data still being retained ) as soon as possible. If you believe that there is a compelling justification for maintaining or using the XY PI, we urge you to provide such information to us immediately."

XY magazine which had billed itself as a source for young Gay and Bisexual men as young as 13 ceased publication in 2007. Originally founded in 1996, and with the later creation of it's website in 2005, XY had attracted young Gay people with such fare as photos and feature stories, along with articles on subjects such as disclosing one’s sexuality and what the law has to say about the age of consent. The website carried articles and features as well, but additionally served as a social networking site where young gays could post profiles and meet other young men.

According to leading CNET Data Privacy expert and journalist Declan McCullagh; 

"In February 2010, XY founding editor Peter Ian Cummings filed a personal bankruptcy petition in federal court without using a lawyer. He listed a vehicle worth $1,500 and zero income, saying he is now a graduate student "living mostly on student loans and small loans from friends and family." Cummings said he has "lived with friends" and has had "no fixed abode for the last three years," and has even lived in his car.

The only significant asset Cummings listed is the "customer list, personal data, and editorial and back issue files of XY Mag and XY.com." Cummings says he believes that giving the information to his creditors violates California privacy law and the FTC Act, which prohibits deceptive business practices.

It's not quite clear what happens next. Cummings appears to have personally guaranteed some of the loans or investments made by his business partners, including Peter Larson and Martin Shmagin. Larson could not be immediately located on Monday; Shmagin, who is owed about $180,000, did not respond to a request for comment."

 Director Vladeck also stated in his five page letter;

It is our understanding that since its inception, the XY.Com's "Sign-up Confirmation Page" told potential members/subscribers:

"Please note our amazing privacy policy. We never give your info to anybody. Similarly, the XY Magazine subscription form stated: "Amazing Privacy Policy: XY never sells its list to anybody!'"

Another statement, which appeared on the website and was directed to magazine subscribers, stated: 

"Our privacy policy is simple: we never share your information with anybody." Those submitting online profile information were told that such information "will not be published. We keep it secret." 

Those submitting articles for possible publication were told that they would be contacted before such articles were used. 
XY also made representations regarding the anonymity of its magazine subscriber base in connection with the distribution of the magazine. According to the publisher, the sexual orientation of many of the magazine and website members/subscribers was not public, including that of some minors living at home with their parents. Indeed, to alleviate concerns about the possible social stigma associated with a subscription, the XY.Com website published the following FAQ:

Q: Will my mom figure out what I'm getting in the mail?
A: Subscription copies of XY are mailed in plain, shrink-wrapped black plastic, with no mention of XY on the mailing label.

For young adults who moved out of their parents' residence during the course of their subscription, XY maintained a change of address webpage that allowed them to immediately update such moves.
In this case, the XY privacy policy is simple, explicit, and clear. Subscribers and members were told that their personal information would not be sold, shared, or given away to "anybody." This includes the names, addresses, profile information, and credit card information submitted by subscribers. It also includes unpublished articles that were submitted, for which permission to publish had not yet been secured. Therefore, any sale or transfer of the data to a new company, new owner, or other third party would directly contravene the privacy representations and could constitute a deceptive practice by the original company or its principals. Such practice also could be unfair.

With regard to the street addresses collected by XY, many of these were provided by minors living with their parents or others who may have been unaware of their sexual orientation. With the passage of time since the magazine and Web site's demise, many of these minors may have moved. At the time the Web site and magazine were operational, minors who moved, especially those concerned about the confidentiality of their subscriptions, were able to go online to update promptly any change of address. Former subscriber expectations, however, have likely changed over the past several years. They do not expect to receive any future communications from XY. The magazine has ceased publication and has been dormant for three years. The Web site no longer functions, making it impossible to update any changes of address, even if there were an expectation that future communications might occur. Accordingly, any effort to contact former subscribers via mail now carries the risk of unintentionally revealing their sexual orientation to individuals residing at the former subscribers' addresses.

The FTC's  warning letter made it clear that the subscriber data for both XY Magazine and user information for XY.com, having been gathered under a promise of confidentiality, may not be sold to others, nor used for a new attempt at publication of the periodical or launching the web site.