First online privacy law looms
But most companies already follow requirements of California's AB 68, experts say
June 24, 2004 12:00 PM ETComputerworld -
The nation's first privacy law targeted specifically at online businesses will go into effect in California on July 1. But it's unlikely to cause many problems for companies, because most of the privacy requirements stipulated by the law are already in place at a majority of commercial Web sites.
The Online Privacy Act of 2003 (Calif. AB 68) was authored by Assembly member Joseph Simitian. Under the law, any online business that collects personally identifiable information from a California resident is required to do the following:
- Post its privacy policies in a prominent manner on its Web site and identify the effective date.
- Inform consumers of the different types of personally identifiable information that's being collected about them, including how the data will be used and shared.
- Describe how individuals can request and make changes to their personal information.
- Specify the process by which any changes to the company's privacy policies will be communicated to consumers.
"If you are going to collect personal information from people, you need to tell them what your privacy policies are and then honor that commitment," Simitian said.
The law is structured in such a manner that anyone can bring an "individual course of action" against companies that fail to comply with it, he said.
AB 68 is the first law to legally formalize something that most online businesses have been doing for some time anyway, said Christopher Pierson, a partner at Lewis and Roca LLP in Phoenix.
"It sets the bar specifically for online merchants," Pierson said. Previously, a consumer would have had to take action such as filing a complaint with the Federal Trade Commission or suing a company under unfair business practice laws to address an online privacy breach, he said.
From an IT standpoint, there is little companies have to change to comply with the law.
"Most companies doing business on the Web have privacy statements," said Kirk Herath, chief privacy officer at Nationwide Insurance Cos. in Columbus, Ohio. "They just need to make sure that their old statements contain all of the elements of the new requirements."
The bill isn't as "threatening" as some other California privacy laws, such as the SB 1386 database breach notification act and the pending SB 1279, which toughens the scope of SB 1386, said one user at a large financial services company who requested anonymity.
Part of the reason may be that the original online privacy bill had been watered down quite a bit before being passed, he said.
According to Simitian, there was strong industry opposition tothe bill over some of the initial provisions. The biggest concern had to do with a provision that required companies to maintain a history of their privacy policies. There was also considerable concern over the prospect of companies having to comply with a patchwork of policies if other states adopted such measures, he said.
Though AB 68 passed the state legislature in 2002, it was vetoed by then-governor Gray Davis. A revised version of the bill was approved in 2003.
Privacy
Additional Resources



Learn the important issues you must consider before starting your next mobility initiative. Get your mobility white paper from IDC now, compliments of Sybase.
White Papers & Webcasts
Forrester Consulting - Optimizing Users and Applications in a Mobile World
Learn how to successfully deploy a WAN optimization solution that is specifically tuned for a mobile environment!
Data Protection and Disaster Recovery with iSCSI and VMware
Get this on demand webcast now
Faster, Cheaper and Easier to Maintain
Can you afford not to upgrade your servers to today's advanced, energy-efficient technologies?
The State of PCI DSS Compliance at Organizations Today
Download this resource today!
Effectively Implementing Datacenter Automation
Effectively select and deploy the best datacenter automation solution today!
IDC Research Report: The Business Value of Consolidating on Energy-Efficient Servers
Download this Resource Now!
Aligning IT to Business: The Rising Importance of Application Delivery Networks
Application Delivery Networking (ADN) will play a vital role in helping enterprises incorporate strategic technologies to achieve business initiatives.
HP Technology Guide for Scalable Business Solutions
Download This Resource Now!
