Two related recent developments emphasize the need to carefully draft and frequently review data privacy policies. The first arises from a term in the privacy policy of a national mortgage corporation, a subsidiary of a national bank, which is posted on its website and states that while it may share information with unaffiliated companies to offer products or services, it provides "the minimum amount of information necessary for that company to offer its product or service." Based on that phrase, the Minnesota Attorney General sued the corporation in federal court alleging that a company telemarketing program violates various state and federal statutes, including the Minnesota False Statements in Advertising Act, Consumer Fraud Act, Deceptive Trade Practices Act, and the federal Telemarketing and Consumer Fraud and Abuse Prevention Act.
