The ACLU is leading a "no-spy pledge" campaign urging retailers such as stores and banks not to voluntarily give private data about customers to the government.A score of large enterprises, including CVS Corp., The Home Depot Inc. and Thrifty Inc., were targeted this month by privacy advocates who want them to refrain from voluntarily giving sensitive data about customers to the government.
Concerned that federal agents are pressuring companies to turn over electronic data even when theyre not legally required to do so, the American Civil Liberties Union is leading a "no-spy pledge" campaign.
The campaign urges consumers to write to the stores, airlines, banks and car rental agencies they frequent and request that these companies not hand over customers personal data unless required by law. The privacy activists hope to rein in the volume of data that the government collects on the average citizen.
Enterprise Rent-A-Car Co. has received "a handful" of e-mail messages regarding the ACLUs surveillance campaign, and it is responding to those that contain a customers address, said Christy Conrad, assistant vice president of public relations at Enterprise, in St. Louis, Mo.
The e-mail privacy debate is heading to Congress. Click here to read more.
Most of the household names in the American retail and services sectors have in place what they consider sufficient data privacy policies. Enterprise Rent-A-Car has a policy that protects its customers privacy, Conrad said, but the company must respond to legal requests from the government.
"We do have a legal obligation to release documentation if we are subpoenaed by appropriate authorities," Conrad said. "Certainly, it is always our intent to protect our customers privacy."
The ACLU, in New York, identified companies that are large and popular, according to Jay Stanley, who authored an ACLU report this month titled "The Surveillance-Industrial Complex: How the American Government Is Conscripting Businesses and Individuals in the Construction of a Surveillance Society." Stanley said his organization plans to add more companies to the list as the campaign progresses.
"This isnt anything thats intended to draw anybody as a bad guy," Stanley said. "Its a selection of companies that millions of Americans do business with."
Click here to read about a pilot program in which an insurance company is tracking its customers cars with wireless devices.
Federal laws carve out specific privacy protections for medical and financial data, but other seemingly mundane information also can be sensitive if aggregated, Stanley said. With increasingly sophisticated data mining technologies and increasingly aggressive security and law enforcement initiatives, the sheer volume of collected information can prove a privacy risk, he added.
"Often, when you put together enough seemingly innocuous information, it starts to get spooky," Stanley said. "Consumer information that may be innocuous for me could be a devastating thing for you to have. It all depends on the context."
What worries privacy advocates most is that the government is using the commercial sector to bypass privacy laws and regulations and that companies may not be aware they are being used this way.
"The government can do surveillance by proxy through the private sector," Stanley said. "The spirit of the privacy act is that the government should not maintain dossiers on individuals who are not suspected of wrongdoing."
For insights on security coverage around the Web, check out eWEEK.com Security Center Editor Larry Seltzers Weblog.
The ACLU said it is not trying to dissuade corporate America from complying with subpoenas or other legal requirements. The organization wants companies to resist pressure to turn over information when government requests are not accompanied by legal mandates.
It is the voluntary disclosure of personally identifiable information to the government—which enterprises may not always realize is voluntary—that the ACLU hopes to curb.
Cendant Corp., the parent company of Avis Rent A Car System Inc. and Budget Rent A Car System Inc., provides law enforcement with the data it asks for, whether legally required to or not, said Susan McGowan, director of public relations at Cendant, in Parsippany, N.J.
"We give whatever the law enforcement agencies request of us," McGowan said. "We balance our customers privacy issues with the needs to comply with law enforcement agencies. Were very stringent on both accounts."
Check out eWEEK.coms Security Center at http://security.eweek.com for security news, views and analysis.
Be sure to add our eWEEK.com security news feed to your RSS newsreader or My Yahoo page: 
Network Security & Hardware 
