Does your web site collect data from users? Whether you allow users to submit personal data (such as email addresses) or simply gather information through cookies, your web site should include a privacy policy to explain how you will use that data. Too often, website managers simply post a form privacy policy without actually reviewing the policy. Can you confirm that your policy accurately describes what your company does with the data that you collect?
In her second article in the “Internet Rules of the Road” series, my colleague Anne Newman of Pepper Hamilton LLP describes key elements that all web site privacy policies should obtain. It also describes legal requirements imposed on all companies who collect data from residents of California. As Anne writes:
Most Web sites cannot isolate their visitors from California, so they must comply with California law for all their visitors. For this reason, California’s requirements have become the standard in the U.S. for Web site privacy policies.
California law requires that a privacy policy (a) disclose the categories of information that identifies persons (“personally identifiable information”) that a Web site collects and the categories of third parties with whom that information will be shared, (b) describe how a user can review and request changes to the personally identifiable information on file with the Web site, if such a process is available, (c) identify the effective date of the policy and (d) describe how users will be notified of changes to the policy.
A Web site owner must understand what is deemed “personally identifiable information” under the law, in order for its Web site privacy policy to be accurate.
To read Anne’s full article, click here.
IP Spotlight 