How The Patriot Act Could Put You In A SpotHow The Patriot Act Could Put You In A Spot

If you've taken your privacy policy seriously, you're rightfully proud of it. But the Patriot Act could make your policy mincemeat.

When lawyers get together to negotiate confidentiality and nondisclosure agreements, there's a dance we go through. Everyone knows the steps in advance. We just wait for the right moment and change of beat to respond. You ask for a carve out of the "public knowledge" information, and I step forward with the "not disclosed in violation of any contractual or legal confidentiality obligation." You counter with "to our knowledge" and I step forward with "or should have known."

As long as you're dealing with experienced privacy practitioners, the dance moves ahead and everyone is happy. For every point, there is an exception, for every exception another point. If one lawyer knows more about these kinds of agreements than the other, perhaps the contract is a bit one-sided, but certain exceptions are considered standard.

One of those exceptions is for legally required disclosures. The language may differ from contract to contract, depending on the template or model used, but essentially the standard exceptions allow the recipient of the confidential information to disclose it pursuant to a court order or other legal process. A knowledgeable lawyer will demand, in exchange for this permitted disclosure, that notice is given to the person or entity protected by the agreement in advance of the disclosure. This allows the protected party to seek a protective order to stop the disclosure, or otherwise challenge the legal process before the information is disclosed.

But what happens when the law prohibits you from informing anyone that their information is being demanded or turned over? You're between a rock and a hard place. And, as your lawyers will tell you, that's where you face serious legal liability. And the Patriot Act doesn't provide any protection for an entity that complies with the Patriot Act in violation of a confidentiality agreement or even a privacy policy that contains an advance-notice provision.

So what do you do? Think ahead! Look over your confidentiality and nondisclosure agreements now, before the government comes knocking. And reach out to the other parties to those agreements notifying them that the Patriot Act prohibits any complying party from disclosing the inquiry or information turnover to the party being investigated. Let them know that in the event an inquiry is made that would otherwise be covered by the agreement, the notice will not be given.

This can be done via a simple letter with a place for their acknowledgement, which is returned to you signed. This letter, if prepared properly, amends the agreement and allows you to comply with the law without risking unnecessary legal exposure. And all future agreement should reflect that, notwithstanding the provision requiring advance notice of legal process before disclosure, all bets are off when the Patriot Act is involved.

Once again, forewarned is forearmed when it comes to privacy.

Return to main story, The Privacy Lawyer: Patriotism, Compliance, And Confidentiality