A Coremetrics spokesman said that the company is legally bound not to disclose the data to anyone else, but did admit that Coremetrics personnel could access it. Curtin argues that's not going far enough. Coremetrics misses the point. They are depending on policy to prevent abuse of this information. But there's nothing technically preventing them from doing this.
Computers fail, systems fail.
Curtin said when a customer makes an order on the vendor's site, portions of their order are encrypted and sent to Coremetrics. This use of encryption makes it very difficult for users to find out what's going on, Curtin said. And while Coremetrics explains on its site what the company does, and allows consumers to opt out of data collection, the vendor sites make no reference to Coremetrics. Their privacy policies state that they don't share personally identifiable information with third parties. Curtin said he found out about the Coremetrics connection to the retailers through an e-mail.