First online privacy law looms
But most companies already follow requirements of California's AB 68, experts say
Computerworld - The nation's first privacy law targeted specifically at online businesses will go into effect in California on July 1. But it's unlikely to cause many problems for companies, because most of the privacy requirements stipulated by the law are already in place at a majority of commercial Web sites.
The Online Privacy Act of 2003 (Calif. AB 68) was authored by Assembly member Joseph Simitian. Under the law, any online business that collects personally identifiable information from a California resident is required to do the following:
- Post its privacy policies in a prominent manner on its Web site and identify the effective date.
- Inform consumers of the different types of personally identifiable information that's being collected about them, including how the data will be used and shared.
- Describe how individuals can request and make changes to their personal information.
- Specify the process by which any changes to the company's privacy policies will be communicated to consumers.
"If you are going to collect personal information from people, you need to tell them what your privacy policies are and then honor that commitment," Simitian said.
The law is structured in such a manner that anyone can bring an "individual course of action" against companies that fail to comply with it, he said.
AB 68 is the first law to legally formalize something that most online businesses have been doing for some time anyway, said Christopher Pierson, a partner at Lewis and Roca LLP in Phoenix.
"It sets the bar specifically for online merchants," Pierson said. Previously, a consumer would have had to take action such as filing a complaint with the Federal Trade Commission or suing a company under unfair business practice laws to address an online privacy breach, he said.
From an IT standpoint, there is little companies have to change to comply with the law.
"Most companies doing business on the Web have privacy statements," said Kirk Herath, chief privacy officer at Nationwide Insurance Cos. in Columbus, Ohio. "They just need to make sure that their old statements contain all of the elements of the new requirements."
The bill isn't as "threatening" as some other California privacy laws, such as the SB 1386 database breach notification act and the pending SB 1279, which toughens the scope of SB 1386, said one user at a large financial services company who requested anonymity.
Part of the reason may be that the original online privacy bill had been watered down quite a bit before being passed, he said.
According to Simitian, there was strong industry opposition to the bill over some of the initial provisions. The biggestconcern had to do with a provision that required companies to maintain a history of their privacy policies. There was also considerable concern over the prospect of companies having to comply with a patchwork of policies if other states adopted such measures, he said.
Though AB 68 passed the state legislature in 2002, it was vetoed by then-governor Gray Davis. A revised version of the bill was approved in 2003.
Read more about Privacy in Computerworld's Privacy Topic Center.
- Mission Critical: Managing Mobile Applications & Content Smartphones, tablets and other mobile devices have become embedded in enterprise processes, thanks to the consumerization of IT and a new generation of...
- Securing Mobility, From Device to Network At one time, the process of managing and securing mobile devices and applications was fairly straightforward. Most organizations worried about one application (email)...
- Planning for Mobile Success Many organizations are seeing clear and quantifiable benefits from the deployment of mobile technologies that provide access to data and applications any time,...
- The Challenges and Opportunities of Mobile Application Development Nearly all business users now demand mobile devices--their own or company-owned--along with anywhere access to corporate applications and data. What turns mobile devices...
- Data Protection and Disaster Recovery with iSCSI and VMware Get this on demand webcast now
- Keep Servers Up and Running and Attackers in the Dark An SSL/TLS handshake requires at least 10 times more processing power on a server than on the client. SSL renegotiation attacks can readily... All Privacy White Papers | Webcasts
Our new bimonthly Internet of Things newsletter helps you keep pace with the rapidly evolving technologies, trends and developments related to the IoT. Subscribe now and stay up to date!