Three AOL subscribers whose records of Internet searches were made available online are suing the company under privacy laws and are seeking an end to its retention of search-related data.
The lawsuit is believed to be the first in the wake of AOL’s release of about 19 million search requests made over a three-month period by more than 650,000 AOL customers, including the three plaintiffs: two unnamed Californians and Kasadore Ramkissoon of Richmond County, N.Y.
Filed Friday in U.S. District Court in Oakland, the lawsuit seeks class-action status. It does not specify the amount of damages being sought.
AOL, a unit of Time Warner Inc., has apologized for the release, which it blamed on a researcher who had failed to gain proper clearances. The researcher and another AOL employee have been fired, and the company’s chief technology officer has resigned. AOL also pledged to name its first chief privacy officer.
John Dominguez, one of the attorneys who filed the lawsuit, said AOL ought to do more.
“People paid AOL with the belief that their privacy was going to be protected,” he said Monday. “That’s not what happened.”
Although AOL had substituted numeric identifications for the subscribers’ user names, the company acknowledged that the search queries themselves might contain personally identifiable data, revealing names, credit card numbers and medical conditions.
AOL removed the data from its website once executives learned of the release but not before copies were already circulating. Websites have even been created specifically to query AOL’s search database.
Dominguez said AOL ought to at least try to shut down those sites or block them from its own search engines. And he said the company should stop collecting such records and destroy any it has.
AOL keeps data linked to specific subscribers for as many as 30 days and other data, such as the search records released, longer. Data retention is standard practice among Internet search engines, which use such information to refine their services.
AOL declined to comment on the suit, which alleges violations of the federal Electronic Communications Privacy Act and California consumer protection laws.