 | Law Unassessed | |||||||||
| ||||||||||
"Shine the Light" Law
| Agreatnotion/sandbox | |
|---|---|
 State Seal of California | |
| Citation | CA Civil Code § 1798.83 |
| Legislative history | |
| Bill title | Personal information: disclosure to direct marketers. |
| Keywords | |
| privacy | |
California's "Shine the Light" law (CA Civil Code § 1798.83[1]) is a privacy law passed by the California State Legislature in 2003. It became an active part of the California Civil Code on January 1, 2005. It is considered one of the first attempts by a state legislature in the United States to address the practice of sharing customers' personal information for marketing purposes, also known as "list brokerage."[2] The law requires companies to disclose at a customer's request how and what personal information is shared with third parties and outlines provisions for enabling customers to opt out of information sharing altogether. The "Shine the Light" law outlines specific language for California residents that a company who does business with any California resident must include in an online privacy policy in order to be in compliance with the law.[3]
History
sponsored by Liz Figueroa, substantially amended, anything I can find re: debate around its passage.
"Transparency is the touchstone of consumer confidence in information handling... Because privacy is, by definition, so intensely personal, for a consumer to make a rational and informed and personal choice to opt-in, opt-out, or simply take their business elsewhere, the consumer must know the "who, what, where and when" of how a business handles personal information."[4]
Requirements
The law applies to all businesses, for-profit or non-profit, that conduct business with any customer in California, with the exception of businesses with fewer than 20 employees and federal financial institutions.[2] The law defines "customer" as "an individual who is a resident of California who provides personal information to a business during the creation of, or throughout the duration of, an established business relationship if the business relationship is primarily for personal, family, or household purposes."[1]
Under the "Shine the Light" law, California defines 27 categories as "personal information" when disclosed to third parties.[1]
| Categories of Personal Information | ||
|---|---|---|
| Name and address | Email address | Age or date of birth |
| Names of children | Email or other addresses of children | Number of children |
| Age or gender of children | Height | Weight |
| Race | Religion | Occupation |
| Telephone number | Education | Political party affiliation |
| Medical condition | Drugs, therapies, or medical products or equipment used | Kind of product the customer purchased, leased, or rented |
| Real property purchased, leased, or rented | Kind of service provided | Social security number |
| Bank account number | Credit card number | Debit card number |
| Bank or investment account, debit card or credit card balance | Payment history | Information pertaining to the customer's creditworthiness, assets, income, or liabilities |
The law contains a few exceptions for information-sharing among different companies of the same brand.
Online privacy policies often include language targeted specifically at California residents.
Add to the home page of its Web site, a link either to a page titled "Your Privacy Rights" or to add the words "Your Privacy Rights," to the home page's link to the business' privacy policy. If the business elects to add the words "Your Privacy Rights" to the link to the business' privacy policy, the words "Your Privacy Rights" shall be in the same style and size of the link to the business' privacy policy. If the business does not display a link to its privacy policy on the home page of its Web site, or does not have a privacy policy, the words "Your Privacy Rights" shall be written in larger type than the surrounding text, or in contrasting type, font, or color to the surrounding text of the same size, or set off from the surrounding text of the same size by symbols or other marks that call attention to the language. The first page of the link shall describe a customer's rights pursuant to this section and shall provide the designated mailing address, e-mail address, as required, or toll-free telephone number or facsimile number, as appropriate. If the business elects to add the words "Your California Privacy Rights" to the home page's link to the business's privacy policy in a manner that complies with this subdivision, and the first page of the link describes a customer's rights pursuant to this section, and provides the designated mailing address, electronic mailing address, as required, or toll-free telephone or facsimile number, as appropriate, the business need not respond to requests that are not received at one of the designated addresses or numbers.
(C) Make the designated addresses or numbers, or means to obtain
the designated addresses or numbers, readily available upon request of a customer at every place of business in California where the business or its agents regularly have contact with customers.
Criticism
Not sure if there is any but it would be worth including if I can find anything.
References
- ^ a b c CA Civil Code § 1798.83. Retrieved on 2011-03-01.
- ^ a b Electronic Privacy Information Center (EPIC). "California S.B. 27, 'Shine the Light" Law.'
- ^ Nick Lieber. "Why Your Web Site's Privacy Policy Matters More Than You Think." BusinessWeek, August 12, 2009. Retrieved on 11-03-01.
- ^ California Senate Judiciary Committee.Bill Analysis, SB 27 Senate Bill, 2003. Retrieved on 2011-03-01.
Sources
Free:
- California State Senate. California Senate Bill 27 (2003-4), Chaptered Version. Via CA.gov.
- Privacy Rights Clearinghouse. "California's "Shine the Light" Law Goes into Effect Jan. 1, 2005." Press Release. Posted December 29, 2004.
- ReedSmith. "Ramifications of California's "Shine the Light" Law." Client Alert, July 01, 2005.
- Anthony D. Milewski Jr. "Compliance with California Privacy Laws: Federal Law Also Provides Guidance to Businesses Nationwide." University of Washington, Shidler School of Law. 2 Shidler J. L. Com. & Tech. 19 (Apr. 14, 2006).
- California State Senate. Senate Bill 27 (2003-2004) search results
- White & Case. "Burgeoning Privacy Developments in the US." Presentation. Fifth Annual Global Privacy Symposium, April 12, 2005.
- International Association of Privacy Professionals. "California Privacy Laws Reach Beyond California." York, Maine: December 7, 2004.
Behind Pay Walls:
- Margaret Betzel. "Privacy Law Developments in California." I/S: A Journal of Law and Policy for the Information Society, The Ohio State University (2 ISJLP 831). Fall, 2006.
- Corey Ciocchetti. "Just Click Submit: The Collection, Dissemination, and Tagging of Personally Identifying Information." Vanderbilt Journal of Entertainment and Technology Law (10 Vand. J. Ent. & Tech. L. 553), Spring, 2008.
- http://en.wikipedia.org/wiki/Template:Infobox_Legislation
