It's Time To Review Your Privacy PolicyDo you have a website that markets to and sells to residents of California? If so, you should know that there is a new California law that impacts your business. California lawmakers are making customer privacy a priority and its laws are having an impact well beyond its borders. Its reach now includes all e-commerce merchants who collect personal data from customers who reside in California. This new law, called the California Online Privacy Protection Act of 2003 (COPA), went into effect on July 1, 2004. It requires that any website that collects personal data on California residents must "conspicuously post" a privacy policy on their website describing their policies with regard to that data.
COPA identifies the specific requirements that must be addressed in every covered privacy policy including:
Identify the categories of personally identifiable information collected about consumers.
Identify the categories of third-party persons or entities with whom the operator shares that personally identifiable information.
Provide a description of the process by which a consumer may change his or her personally identifiable information with such operator (if the operator provides such a mechanism).
Describe how the operator will notify consumers of changes to the site's privacy policy.
Identify the policy's effective date.
To address these issues, you will need to devise a means by which you will not just draft a new policy that complies with this law, but to actually have a plan and a means by which you can implement the provisions of your new privacy policy. You should also have a clear understanding of what may be construed as being "personally identifiable information." Though this new law has broad interpretation, most experts agree that this can simply include any means by which you can contact your customers, including email address, phone number and more. It is too early to tell if cookies and other tracking statistics are included in "personally identifiable information." It will be up to the courts to make that decision. As for what would constitute "conspicuously posting," that would mean posting it on the home page or the first significant page of your site. There should either be a button or a hyperlink that links to the privacy policy page.
Failure to do so is a violation of COPA when non-compliance is either negligent and material or willful and knowing. Failing to do so within 30 days of being informed of your non-compliance would also cause a site operator to be in violation. Such violations may subject the site operator to civil suits for unfair business practices. At the federal level, the Federal Trade Commission may bring a deceptive or unfair trade practices charge against a company that does not accurately disclose its practices. As for the frequency and strength of its enforcement, that remains to be seen.
If don't yet have a posted privacy policy, now is the time to consider posting one on your website. The Better Business Bureau is a reliable resource to view a sample privacy policy: http://www.bbbonline.org/reliability/privacy.
