This policy (link via eBay Customers' Privacy Not Protected at The Shifted Librarian) is just scary. TSL is referencing a post on LawMeme today detailing comments by Joseph E. Sullivan, Director of Compliance and Law Enforcement Relations, Senior Counsel, Trust and Safety for eBay. Sullivan apparently made the comments to law enforcement officials at the CyberCrime2003 conference last week in Connecticut (he's on the speaker list for a session called "eBay: Working with Law Enforcement"). In short, Sullivan confirmed that
Without a subpoena [emphasis added by JK], eBay will provide the following information regarding an eBay user to law enforcement:
Full Name, User ID, Email Address, Street Address, State, City, Zip Code, Phone Number, Country, Company, Password, Secondary Phone, Gender, Personal or Business, Shipping information (Name, Street Address, City, State, Zip)
In addition eBay will provide the following transaction information:
Bidding History on an Item, Other Items for Sale, Feedback about a user, Bidding history of a user, Prices paid for items, Feedback rating, and Chat Room/Bulletin Board (!)....
Jenny comments that eBay is "acting like the anti-librarian (let's proactively give away information about our customers!)" and continues "If you use eBay, you should let them know how you feel about this, too."
The gist of the presentation (per LawMeme's report, anyway) was that eBay does not require a subpoena for access to this kind of information. Now, I'm not an attorney, but this seems to imply that eBay is empathizing with the poor law enforcement officials who are forced to jump through all of those hoops and deal with all of that red tape in order to access personal information about the target of an investigation. Yes, those poor police investigators. This goes to my "I'm not an attorney" statement, but--is it really that difficult to get a subpoena? Doesn't a subpoena simply mean that a judge somewhere has agreed with the prosecutor that there might be evidence of a crime in the requested data?? These are not rhetorical questions--I'm actually asking.
I certainly understand that eBay has a business interest in preventing fraud on its site, and I might even consider it reasonable for eBay to proactively call in law enforcement if an internal audit of some sort revealed potential fraud. But to simply hand over that information when it is requested, without the backing of a judge--it's just scary, and it's enough to make me think twice before I'd consider using their services (I, like TSL, have never used eBay).
This makes me wonder what Amazon's policy is, though, as the other big eRetailer out there with eBay, and how either of their policies vary based on the jurisdiction of the law enforcement personnel making the request.