Henry J. Gomez

June 23, 2006

A new policy that takes effect today at AT&T could mean less privacy for many Web surfers.

The change at the nation's top telephone company, which has more than 7 million Internet service subscribers, raises a new question: Who really owns your confidential data?

AT&T's revised privacy policy, which affects only its Internet customers and future subscribers to a soon-to-launch video service, explicitly classifies personal account information as "business records" that are owned by the San Antonio telecommunications giant.

"As such," the new policy states, "AT&T may disclose such records to protect its legitimate business interests, safeguard others, or respond to legal process."

Critics argue that the revisions are too broad and give AT&T more latitude to share data with the federal government. Some also question the timing of the changes.

The policy takes effect on the same day that oral arguments are scheduled on the federal government's motion to dismiss a class-action suit against AT&T. The suit accuses AT&T of illegally working with the National Security Agency in support of a domestic spying program.

AT&T spokeswoman Tiffany Nels said the company had been working on the privacy policy update for several months. The revisions, she said, are simply a result of the company's recent merger with SBC -- which had a slightly different policy -- and the imminent roll-out of video service that is intended to compete with cable providers.

"For AT&T Internet users, there really are no significant changes," Nels said.

Nels said the new policy is a "more plain-English approach to stating what information we collect and the way we use it. It's all the same and consistent with AT&T's long-standing privacy policy."

But there are some notable changes.

The previous policy, which had been in effect since September 2004, said AT&T (then known as SBC) could share personal information specifically when responding to "subpoenas, court orders or other legal process, to the extent required and/or permitted by law."

The new policy adds to that statement by declaring that AT&T "may also use your information in order to investigate, prevent, or take action regarding illegal activities, suspected fraud" and "situations involving potential threats to the physical safety of any person."

Ray Everett-Church, a Silicon Valley privacy analyst and co-author of the book "Internet Privacy for Dummies," said the new language makes AT&T's privacy policy "even more vague" to the point where the company might not even need a court order to share data.

"The AT&T privacy policy has no business being a privacy policy," Everett-Church said.

Paul Stephens, a policy analyst for the Privacy Rights Clearinghouse in San Diego, said that while there was a lot of confusion about its revisions, he thinks AT&T made one thing clear: It owns customers' personal information and can do with it what it wants.

"We feel it's absolutely outrageous," Stephens said. Nels said AT&T began e-mailing notices of the policy change to Internet customers on Sunday. According to the document, users "must agree to this policy" as a condition for service. Nels said Internet subscribers will consent by continuing to use the service. Those who disagree should cancel their AT&T Internet accounts and switch to another provider.

As for AT&T's imminent broadband video service, known as Project Lightspeed, subscribers would be asked to sign the privacy policy upon installation, Nels said. But privacy analysts also are quibbling about language regarding the company's plans to monitor viewing habits.

Nels said AT&T will be no more intrusive than TiVo, the gadget that not only records your favorite shows but also your personal preferences based on what you watch and how often.

"Of course," said Stephens of the Policy Rights Clearinghouse, "a lot of people find TiVo objectionable. People refuse to use TiVo because of the tracking they do." But telecommunications industry analyst Gary Arlen, president of Arlen Communications Inc. in Bethesda, Md., suggested that the privacy concerns might be overblown.

"This is the digital era," Arlen said. "Data about you is everywhere. At least AT&T is telling you they've got it."