AOL Subscribers Sue Company Over Leak of Search Records

NEW YORK – Three AOL subscribers who suddenly found records of their Internet searches widely distributed online are suing the company under privacy laws and are seeking an end to its retention of search-related data.

The lawsuit is believed to be the first in the wake of AOL's intentional release of some 19 million search requests made over a three-month period by more than 650,000 subscribers, including the three plaintiffs — two unnamed Californians and Kasadore Ramkissoon of Richmond County, N.Y. [which is the Staten Island borough of New York City].

Filed Friday in U.S. District Court in Oakland, Calif., the lawsuit seeks class-action status. It does not specify the amount of damages being sought.

• Click here to visit FOXNews.com's Cybersecurity Center.

• Click here to visit FOXNews.com's Home Computing Center.

AOL already has apologized for the release, which it blamed on a researcher who had failed to gain proper clearances.

The researcher and another AOL employee have been fired, and the company's chief technology officer has resigned. AOL also pledged to name its first chief privacy officer.

• Click here to read a copy of the lawsuit (FindLaw).

John Dominguez, one of the attorneys who filed the lawsuit, said AOL ought to do more.

"People paid AOL with the belief that their privacy was going to be protected," he said Monday. "That's not what happened."

Although AOL had substituted numeric IDs for the subscribers' real user names, the company acknowledged the search queries themselves may contain personally identifiable data, revealing names, credit card numbers and medical conditions.

In fact, The New York Times was able to trace user 4417749 to Thelma Arnold, 62, of Lilburn, Ga., while The Washington Post tracked down JoAnn Whitman, 55, of Grand Junction, Colo., after she accidentally typed into AOL's search engine an e-commerce order confirmation.

AOL removed the data from its Web site once executives learned of the release, but not before copies were already circulating. Web sites have even been created specifically to query AOL's search database.

Dominguez said AOL ought to at least try to shut down those sites or block them from its own search engines. And he said the company should stop collecting such records and destroy any it already has.

AOL currently keeps data linked to specific subscribers for up to 30 days and other data, such as the search records released, for longer.

Data retention is standard practice among Internet search engines, which use such information to refine their services.

AOL LLC, a unit of Time Warner Inc. (TWX), declined comment on the lawsuit, which alleges violations of the federal Electronic Communications Privacy Act and California consumer-protection laws.

Two privacy advocacy groups, the Electronic Frontier Foundation and the World Privacy Forum, already have filed complaints with the Federal Trade Commission.