|
Knitting legal patchwork quilts
By Scott Bradner
One of the most difficult features to deal with on the
Internet is the lack of any understandable localization
of authority.
Once upon a time when a country or state within a
country enacted a law regulating some aspect of human
or corporate behavior, it was generally easy to figure
out if the law applied to you. A Boston law against
spitting on sidewalks or regulating the size of
billboards could be safely ignored in Chicago. Chicago
could have its own laws dealing with spitting or
billboard size, and those laws would apply to people or
businesses in Chicago. It's not so easy to similarly
localize a law's area of application when the law
applies to activity or content on the Internet.
With the Internet, a German law restricting the
publication of Nazi propaganda or an Australian libel
law can have effects in the U.S., as has been proven in
the last few years. Within the U.S. we have been
getting a spate of state laws that might or might not
affect out-of-state companies providing services over
the Internet or out-of-state Internet users.
California has been particularly good at passing such
laws, but I wonder if California's aggressiveness will
be rewarded by federal pre-emption.
I've already written about what has been referred to as
the California Database Breach Disclosure Act. (See
nwfusion.com/columnists/2004/0517bradner.html
and, for the text of the act, see
<http://www.nwfusion.com/nlgibrad316> )
The act was passed two years ago and requires companies
to tell customers about any break-ins. Until next Jan.
1 the only pain that the customer suffers is embarrassment.
After Jan. 1 the recipient of such a letter might be
able to forward the disclosure letter to their lawyer
who could start getting a lawsuit together.
California has just added teeth to the break-in
disclosure act with a new law
(see <http://www.nwfusion.com/nlgibrad769> )
approved by the governor last month that requires
companies with unencrypted data described in the law to
"implement and maintain reasonable security procedures
and practices" to protect the data. The new law does
not block private lawsuits, so you can
expect that many disclosures will result in lawsuits -
maybe you better figure out how to encrypt the data.
Another California law that went into effect on July 1
requires that Web sites that deal with individual
consumers residing in California publish and abide by
privacy statements
(see <http://www.nwfusion.com/nlgibrad770> ).
The law includes specific requirements about what the
privacy statements have to include and how they have to
be advertised on the Web site. This law also does not
block private lawsuits.
Finally, another new law due to take effect on Jan. 1
requires any California company employing more than 20
people that collects a range of personal information
about individuals to disclose, upon request, what
information they share with with direct marketers
( <http://www.nwfusion.com/nlgibrad771> ).
Depending on the definition of a "California company"
this last bill might or might not affect companies
outside of California, but because the law specifically
permits awarding a penalty, I expect some lawyers will
test the boundaries.
California is not alone. Other states are also passing
these types of laws. The last time we had a lot of
state-level laws being passed it was over spam. Bowing
to business complaints of having to deal with a legal
patchwork quilt, the U.S. Congress
passed the permission-to-spam act
nwfusion.com/columnists20040426bradner.html
I expect the same thing to happen with each new hot
issue - Congress will pass legislation to preempt and
gut the much stronger state initiatives.
Disclaimer: Harvard is not of one mind on legislation,
the B school likes legislation that guts rules, the
school of government likes any legislation, and the law
school likes conflicting legislation, but I consulted
none of them for this column.
Bradner is a consultant with Harvard University's
University Information Systems. He can be reached at <mailto:sob@sob.com>.
--
LP
"We are fighting today for security, for progress,
and for peace, not only for ourselves but for all
men, not only for one generation but for all
generations. We are fighting to cleanse the world
of ancient evils, ancient ills."
Franklin Delano Roosevelt
State of the Union Address - 1942
|
| |
| |
|
