Is it legal, lawful and or ethical for Rgis LLC to provide confidential employee email addresses to third parties such as Blackstone Group and its agents such as Next Jump, Inc?

An anonymous commenter in this blog has raised this interesting question, which eventually became the title of this post. I appreciate anonymous for raising the question.

Before I proceed, let me state my disclaimer:

Any information expressed from here are my personal opinion. It does not solicit, constitute or construed to have legal basis, implications, weigh, or merit to a particular case, or any case in dispute. All data are for nformational purposes only. It is always best to consult a lawyer should you have similar case or question in mind.

First, on the contrary, Blackstone Group is no longer a third party outside of RGIS LLC. Blackstone Group OWNS a controlling interest in RGIS LLC since March 2007. As far as how much is the "controlling" interest of Blackstone Group has to RGIS has not been revealed by either of them. But we all know that "controlling interest" could mean any number between 51% to 99% majority ownership. Please read this link for more info.

The Blackstone Group is probably one of the largest independent alternative asset managers in the world. Its asset management businesses include the management of corporate private equity funds, funds of hedge funds, mezzanine funds, real estate opportunity funds,senior debt funds, proprietary hedge funds, and other mutual funds. And RGIS LLC is one of the many acquisitions it has for the last 5 years.

Second, Next Jump, Inc is a third party agent which Blackstone hires its proprietary service to offer loyalty programs to RGIS' 40,000+ strong employees via its CorporatePerks retail portal. You can visit the website here. As I said from an earlier post, Next Jump is the premier provider of merchant funded loyalty rewards programs. 

Third, Does providing or disclosing confidential employee email addresses to third parties are legal, lawful, or ethical for RGIS LLC to perform?

"When submitting your personal information to a web service of a company, it is always best to read the company's Terms of Use and Privacy Policies first before making such move."

The ethics and legitimacy of whether or not disclosing confidential information of employees by RGIS depends on 2 distinct factors: (1) How RGIS crafted the agreements as stipulated from its Terms of Use agreements and its policies on managing and disclosing personal informations and other privacies. and (2) how laws that govern confidentiality of personal information are being interpreted may differ from other geographical locations.

I am going to answer the first: When users access or use online services of a company or business, they are legally bound by the Terms of Use and Privacy Policies of that online service or business. When you submit your personal information such as names, address, telephone numbers, email address, sss number, etc. into a website or similar online registration service, you are agreeing and acknowledging that those personal information can be disclosed to other parties, or use by RGIS for other purposes such as email communications, company services, employment updates, or other purposes depending on how they are being stipulated. In the case of RGIS, it seemed very clear with this purpose:

"RGIS may collect Personal Information that is inputted and communicated to RGIS through the site. For example, inputted and communicated information may include first and last name, business name, social security number, physical address, e-mail address, telephone number, or other information associated with a particular business entity or individual. RGIS may use inputted and communicated information to contact the particular business entity or individual with respect to RGIS services, RGIS operations, and RGIS employment opportunities, or as needed to address the specific reason for which the information was inputted or communicated to RGIS. RGIS may retain the inputted and communicated information for its records."

The policies quoted above seemed very broad and it does not mention whether or not those personal information can be disclosed to other third parties, affiliates, or subsidiaries of RGIS LLC. However, if we read on the entire policy, whe shall read the following that specifically tells about information disclosure:

"In the course of responding to requests for information and sending you other offers, we may share your Personal Information with agents, contractors, or partners of RGIS who act on RGIS's behalf in performing these functions. We may share your information with controller and processers, including RGIS affiliates and subsidiaries or service suppliers who work on behalf of RGIS and our business partners, to send you communications you may find of interest..."

Another reason why RGIS or any other legitimate company discloses personal information is to aid government for investigation. Here's the words from RGIS' privacy policy:

"...to defend the Company in legal proceedings or others such as legal authorities, when required by law, legal proceedings or subpoena."

By law, companies that engage online services must provide visitors, users, clients, and affiliates a free access to their set of privacy policies. Policies were crafted and worded differently from one another but the ideas behind are pretty much similar. Policies change depending on many factors such as but not limited to: changes or ratifications of laws that govern them, market trends, internal corporate policies, users' experiences, economic demands, etc. 

Here's my $0.02 advise: Before you access and submit your personal information via online registration form, online job application, or purchase a product or services from the internet, or respond to an offer, it is always best to read the company's Terms of Use and/or Privacy Policies before making your first move. If you do not agree with their terms, it is best not to divulge your personal information. Understand that your actions as a user or visitor of a website and the actions of the online business you are accessing are both bound by applicable international, federal, state, or local laws.

However, when you feel, or have the reasons to believe that your sensitive personal information have been disclosed in bad faith by your company, or have been compromised either by negligence, a system hack, or by fraud, it is your personal prerogative to seek legal advise.

Further Reading: