|
Selected State Laws Related to Internet Privacy
Last update: February 7, 2012
Americans express great concerns about privacy on the Internet, and some state legislatures have responded in various ways to this complex issue. State legislation specifically relating to Internet or online privacy includes the following types of laws:
Privacy--Certain Online Activities
Privacy of Personal Information Held by ISPs
Employee E-mail Communications and Internet Access
Privacy Policies for Web Sites
Privacy Policies: Government Web Sites
See also related Internet privacy laws: electronic surveillance, phishing, spyware, security breaches, and spam laws.
Privacy: Online Activity
Cal. Govt. Code § 6267
Protects an individual’s privacy when using online library resources, such as writing email or text messages, online chat or reading e-books.
Cal. Civil Code § 1798.90
The California Reader Privacy Act protects information about the books Californians browse, read or purchase from electronic services and online booksellers, who may have access to detailed information about readers, such as specific pages browsed.
Privacy of Personal Information Held by ISPs
Two states, Nevada and Minnesota, require Internet Service Providers to keep private certain information concerning their customers, unless the customer gives permission to disclose the information. Both states prohibit disclosure of personally identifying information, but Minnesota also requires ISPs to get permission from subscribers before disclosing information about the subscribers' online surfing habits and Internet sites visited.
In addition, California and Utah laws, although not specifically targeted to on-line businesses, require all nonfinancial businesses to disclose to customers, in writing or by electronic mail, the types of personal information the business shares with or sells to a third party for direct marketing purposes or for compensation. Under the California law, businesses may post a privacy statement that gives customers the opportunity to choose not to share information at no cost.
Employee E-mail Communications and Internet Access
Two states, Connecticut and Delaware, require employers to give notice to employees prior to monitoring e-mail communications or Internet access. Colorado and Tennessee require states and other public entities to adopt a policy related to monitoring of public employees' e-mail.
Connecticut
General Statutes of Connecticut § 31-48d
- Employers who engage in any type of electronic monitoring must give prior written notice to all employees, informing them of the types of monitoring which may occur.
-
If an employer has reasonable grounds to believe that employees are engaged in illegal conduct and electronic monitoring may produce evidence of this misconduct, the employer may conduct monitoring without giving prior written notice.
-
Provides for civil penalties of $500 for the first offense, $1,000 for the second offense and $3,000 for the third and each subsequent offense.
Delaware
Delaware Code § 19-7-705
- Prohibits employers from monitoring or intercepting electronic mail or Internet access or usage of an employee unless the employer has first given a one-time written or electronic notice to the employee.
- Provides exceptions for processes that are performed solely for the purpose of computer system maintenance and/or protection, and for court ordered actions.
- Provides for a civil penalty of $100 for each violation.
Public Employers
In addition, Colorado and Tennessee require certain public entities to adopt a written policy on monitoring of email:
Colorado Rev. Stat. § 24-72-204.5
Tennesee Code § 10-7-512
-
Requires the state or any agency, institution, or political subdivision thereof that operates or maintains an electronic mail communications system to adopt a written policy on any monitoring of electronic mail communications and the circumstances under which it will be conducted.
-
The policy shall include a statement that correspondence of the employee in the form of electronic mail may be a public record under the public records law and may be subject to public inspection under this part.
California (Calif. Bus. & Prof. Code §§ 22575-22578)
California's Online Privacy Protection Act requires an operator, defined as a person or entity that collects personally identifiable information from California residents through an Internet Web site or online service for commercial purposes, to post a conspicuous privacy policy on its Web site or online service and to comply with that policy. The bill, among other things, would require that the privacy policy identify the categories of personally identifiable information that the operator collects about individual consumers who use or visit its Web site or online service and third parties with whom the operator may share the information.
Connecticut (Conn. Gen Stat. § 42-471)
Requires any person who collects Social Security numbers in the course of business to create a privacy protection policy. The policy must be "publicly displayed" by posting on a web page and the policy must (1) protect the confidentiality of Social Security numbers, (2) prohibit unlawful disclosure of Social Security numbers, and (3) limit access to Social Security numbers.
Nebraska (Nebraska Stat. § 87-302(14))
Nebraska prohibits knowingly making a false or misleading statement in a privacy policy, published on the Internet or otherwise distributed or published, regarding the use of personal information submitted by members of the public.
Pennsylvania (18 Pa. C.S.A. § 4107(a)(10))
Pennsylvania includes false and misleading statements in privacy policies published on Web sites or otherwise distributed in its deceptive or fraudulent business practices statute.
Privacy Policies: Government Web Sites
At least sixteen states require, by statute, government Web sites or state portals to establish privacy policies and procedures, or to incorporate machine-readable privacy policies into their Web sites.
|