• by Wendy Davis  @wendyndavis, January 22, 2009

An appeals court has dealt AOL a blow in a lawsuit stemming from one of the biggest online privacy breaches to date.

The Ninth Circuit Court of Appeals ruled that California AOL members could pursue a class-action lawsuit against the company in that state, rejecting AOL's argument that the case belonged in Virginia.

The case dates back to July 2006, when an AOL employee publicly released search logs showing the queries made by more than 650,000 members over a three-month period. AOL "anonymized" the members' IP addresses, but the queries themselves contained clues to people's identities--including names, addresses and phone numbers.

One "anonymized" user, Thelma Arnold, was profiled in The New York Times after reporters identified her based on her search queries. The search data was available online for about two weeks before it drew widespread attention, at which point AOL attempted to remove it. But other sites had already copied the material by then.

The incident, which became known in the blogosphere as the "Data Valdez," is still held up as an example of how easily Web users who are supposedly anonymous can be identified based on their search histories.

In September 2006, AOL members sued in California, alleging that AOL violated federal and state privacy laws. AOL contended that its membership agreement called for disputes to be resolved in Virginia. U.S. District Court Judge Saundra Armstrong agreed with AOL, but the Ninth Circuit reversed that ruling.

The appellate court found that requiring California residents to sue in Virginia state courts would violate California public policy, because California gives consumers more legal rights than Virginia state courts.