Remsburg v. Docusearch, Inc.

What happened

In 1999, a man named Liam Youens used Docusearch, an online information broker run by a Florida-licensed private investigator, to track down Amy Lynn Boyer, a young woman he had fixated on. He paid a series of small fees, roughly $150 in total, through the company's website.

Over several requests, Docusearch gave Youens Boyer's date of birth and her Social Security number. To get her workplace, a subcontractor placed a "pretext" call to Boyer, lying about who she was and claiming to be connected to Boyer's insurance company, and got Boyer to say where she worked. A search tied to her Social Security number produced her home address.

On October 15, 1999, Youens drove to Boyer's workplace and shot and killed her as she left, then killed himself. He had kept a website describing his plans to stalk and kill her.

Boyer's mother, Helen Remsburg, sued Docusearch in federal court as administratrix of her daughter's estate. The federal court sent several unsettled questions of New Hampshire law to the New Hampshire Supreme Court. In February 2003, that court issued the ruling known as Remsburg v. Docusearch. The case later settled for $85,000.

What the court held

The federal court asked whether a broker could be held responsible under state law. The court's answers let the suit go forward.

Duty of care: A broker or investigator who sells someone's personal information owes that person a duty of reasonable care when criminal misuse of the information is foreseeable. Boyer had no relationship with Docusearch. The court held that did not matter. The risk came from the broker's own line of business.

Selling a Social Security number: Selling a person's Social Security number without their knowledge can support an invasion-of-privacy claim. Whether the conduct was offensive enough was left for a jury.

Pretexting: Getting Boyer's workplace by lying to her violated New Hampshire's Consumer Protection Act and could itself be an invasion of privacy. That was separate from the sale of the data.

The court did not decide that Docusearch was actually liable. It ruled that the family's claims could go to a jury. The case settled before any verdict.

Why the case still matters

Remsburg is still one of the strongest United States decisions holding that a data broker can be sued when its data is used to cause physical harm. Most states have not gone as far. Courts elsewhere cite New Hampshire's reasoning but rarely adopt it as their own rule.

For someone whose work makes them a target, the case is a legal template for after-the-fact harm. To use it, three things generally have to line up:

• The criminal misuse was foreseeable. For the broker industry, that is now well established.
• The victim was identifiable. The sale was tied to one named person.
• The data led to the harm. The buyer used the broker's information to find the victim.

Where those hold, Remsburg supports a claim in states that respect out-of-state common-law reasoning.

What the case does not reach

Remsburg is a tort case, and torts require harm. If a broker lists your home address but no one has used it against you or your family, this case gives you no remedy. Getting information taken down before harm is the job of removal-focused laws, not Remsburg.

The decision also has limits:

• State by state: Other state supreme courts are not bound by it. Some lower courts elsewhere have reasoned similarly, but few high courts have adopted the rule.
• Foreseeability disputes: Brokers still argue they cannot foresee misuse because they sell in bulk. That argument has weakened over time but is still raised.
• Pretexting has shifted: The industry has moved from explicit pretext calls toward bulk data resale, so the pretext theory matters less today. The negligence theory is more durable.

The remedy is also reactive. Boyer was already dead when the suit was filed. Removal-focused privacy laws that came later exist because after-the-fact liability comes too late. Daniel's Law lets covered officers, judges, and prosecutors in New Jersey demand that brokers take down their home address and unpublished phone number. The Driver's Privacy Protection Act limits who can obtain the personal information in your state DMV records. The Lieu Act gives federal judges and their families the same kind of removal right at the national level.

What it changed

The case brought national attention to the data broker industry. Boyer's family appeared on news programs and testified before Congress, and news outlets ran stories on what brokers collect and sell.

It also drew national attention to pretexting, the practice of getting information by lying about who you are, and to the open sale of Social Security numbers. The negligence theory it endorsed still underpins how modern broker-tort claims are framed.

The Boyer-Docusearch incident page covers the underlying facts in more detail. This page covers the legal holding.

What this means for your own exposure

The case is the exception, not the rule. Most exposure never produces a lawsuit, and most brokers face no consequence for listing a home address and phone number. That is why getting the information removed matters more than the odds of suing after the fact. Frontline Privacy finds exposed listings and files removal requests on the data broker and people-search sites where your information shows up.