• by Wendy Davis  @wendyndavis, February 19, 2013

AOL has agreed to pay $5 million to resolve a class-action lawsuit stemming from one of the worst privacy breaches of the last decade -- its public release of users' search queries.

The 2006 incident, known as the Data Valdez, occurred when employees at AOL posted three months' worth of search queries from 650,000 members. AOL employees did so for research purposes, and took steps to "anonymize" the members.

Despite those measures, some users were identified based on the patterns in their search queries. Most famously, within days of the July 2006 data release, The New York Timesidentifed AOL user Thelma Arnold.

AOL made the data available for several weeks on the site research.aol.com. By the time the company realized the privacy implications and pulled the material, the data had already been downloaded by third parties and made available on mirror sites.

The settlement agreement calls for AOL to pay up to $100 to people who were members between March and May of 2006, and who believe they were identified based on their search queries. If any members of that group think they should receive more than $100 compensation, they can seek a higher award from an arbitrator.

The company also has to pay up to $50 to members who believe in good faith that their queries were included in the public release. Members who fall into those categories must submit claims in order to receive payment.

Beyond simply generating bad publicity for AOL, the incident highlighted how "anonymous" information can result in the identification of specific individuals. A 2009 FTC report about behavioral targeting cited the data breach as one reason why it might not make sense to have different privacy standards for "personally identifiable information," like names, and "anonymous" information, like clickstream data.

The Data Valdez also spawned the short movie "I Love Alaska," which profiles a middle-aged Texas woman, User No. 711391, based on her search queries.

The incident led to litigation, including a class-action lawsuit filed by Sandra Landwehr in the Eastern District of Virginia. Last year, attorneys for Landwehr and AOL arrived at a settlement agreement, which was tentatively approved in December by U.S. District Court Judge Claude M. Hilton in Alexandria.

Hilton ordered AOL to inform people about the settlement by publishing notices in Better Homes & Gardens, Jet, National Geographic, People, Reader's Digest, Sports Illustrated, Time, TV Guide, American Profile, Parade, and USA Weekend. Some of those notices were published last weekend. The settlement agreement doesn't require AOL to send email notifications to users.

It's not yet clear how many AOL members will submit claims -- especially because many users don't know whether their search queries were publicly released. The settlement notice itself states there is no way for people to determine whether their data was published, based on their usernames.