David Platt feels as though he is being blackmailed. And he fears his identity will be stolen in the process.
“It’s wrong,” Platt said. “It’s just wrong.”
Here’s the situation.
When his hard drive crashed, David sent the disk away for recovery.
The company recovered some files, but none of the ones he specifically requested.
So, David disputed the 383 dollars he had paid.
“I won,” he said, nomoting that the bank had sided with him.
Local
But that victory triggered an unexpected twist.
David says the hard drive company informed him it was keeping a copy of his data -- including photos, e-mails, and financial records – and it could sell it all to settle the payment dispute.
“I immediately thought: This is what extortion feels like,” Platt said. “I felt like they sent the guys with the baseball bats to my house.”
Secure data rescue pointed David to its “terms and conditions,” which customers must agree to.
The second to last paragraph says it “may take all steps necessary, including selling the data, to recoup the costs” of a dispute.
“Not only is my data not really rescued, it’s not really secure,” Platt said. “So, Secure Data Rescue is nothing.”
David fears a corrupt buyer could steal his identity. And so did we. So, we contacted “secure data rescue” in Georgia.
Co-owner Matthew Rice defended his company’s contract as necessary to combat fraud.
Rice said he’s never actually sold anyone’s data, but he also refused to return or delete David’s data.
“It’s our data, we can do with it as we please,” Rice said by phone.
“When this company threatens to sell your data, it’s basically like holding you hostage,” said Anna Han, a professor of law at Santa Clara University.
Han reviewed the Secure Data Rescue contract. She noted how one paragraph “guarantees not to disclose” data to third parties, yet another authorizes “selling the data.”
“They are completely at odds,” Han said.
Next, we visited two long-standing data recovery companies for their reaction to the possible sale of David Platt’s data.
“That just shocked me,” said Scott Moyer, President of DriveSavers in Novato.
“It upset me and made me angry,” said Alex Rabinovich of Secure Data Recovery in Los Angeles.
Both firms told us data recovery companies do generally hold customer data, but only briefly -- in case of shipping trouble.
“After 14 days, it’s purged,” Rabinovich said.
Both companies insisted they have no right to sell your data.
But, they complain the rules are murky because data recovery is largely unregulated.
“I wish there was some sort of regulation put in place that you have to go through a process to be verified,” Moyer said.
We asked Rabinovich if his field should be regulated.
"I would welcome it,” he said.
Hundreds of companies offer data recovery services online. So, how do you choose one?
The experts recommend asking your device manufacturer and ask for a list of authorized service providers.
“If it’s Apple, call apple,” Moyer said. “They check them out. They vetted them. They made sure they had the capabilities.”
As for David Platt, he feels he has a gun to his head with his data possibly up for sale.
He said, “We’ve got to buy it back, don’t we?”
Platt is he’s frustrated and fearful. But also motivated to share his story.
“I’m doing this to try to tell the next person to avoid these guys,” he said.
We shared David’s case with the Federal Trade Commission, which says it sues those that “put consumers’ personal data at unreasonable risk.”
The FTC encouraged David to file a formal complaint.
He has.
