Privacy Law Traps for U.S. Businesses

Oct 5, 2016
QUESTION:  We are a New York based translation services business. We receive for translation documents with personal information such as birth certificates and immigration related forms which contain detailed biographical data. We plan to transfer the documents to various translators from all over the world by means of chat applications such as Whatsapp. How do we go about making sure the personal information is not misused by these translators? Will the fact that we will have them (the translators) sign an online contract promising to adhere to our privacy policy suffice to make us not liable to any misuse by them? 

ANSWER:  No.  In the United States you will be held liable for any misuse of personal information, whether the misuse is your own doing or that of any agent of yours.  In our times, when theft of personal data is rampant, the ensuing liabilities can be disastrous.  As such, given that no single approach is likely to offer total protection, I recommend a multi pronged course of action to limit liability.  First, I would seriously vet the translation services you do business with. I would require them to have insurance coverage with a reputable insurer and possibly obtain proof that you will be named as an additional insured under the policy.  Insist on a known insurer, such as Assicurazioni Generali, which covers most of the world, and insist for their policy to cover losses in the United States.  Second, I would draft a very detailed contract to be executed by the translators indemnifying you fully from any misuse of the information.  Here it is important to understand that in some countries that contract will not worth the paper it is written on and will be of very little practical use to you.  Third, I would check you general business insurance policy and include separate and additional coverage to protect you in case of a mishap (or worse).  Be aware however that most policies exclude intentional wrongs or crimes from coverage.  Fourth, if you must deal with untested foreign translators, I would withhold or redact the most sensitive information from the materials you send them, and plug these back in once you receive the rest of the translation body.  Of course, this may well present a technical and legal problem, because in effect the foreign translator is not able to certify the accuracy of materials he did not actually read in their totality.  You may be able to get around this by having a local translator certify the final product. Finally, it is highly advisable to run your business through an LLC or a corporation so as not to incur any personal liability if the all other safeguards fail.    Robert S. Popescu, Esq.