In what situations are web services required to protect confidentiality of user information?

Question

I know that if a web application needs to be PCI-DSS or HIPAA compliant the user personal identifiable information (e.g. user password, etc) needs to be kept confidential.

Under what other situations would the web application/system be required to protect user personal identifiable information?

Answer 1

The answer is highly jurisdiction-dependent, but here's the general outline of the answers in the US:

• If you promise to protect the confidentiality of user information (e.g., in a privacy policy), you must do so. Failing to live up to your promises may be viewed as unfair or deceptive trade practices, and the FTC has jurisdiction to prosecute companies who do so.

• If you have signed a contract promising confidentiality, you must do whatever you promised to do in your contract.

• In the US, if you manage data for video rental subscribers, you may be required to protect confidentiality. The US has special laws governing privacy for video rentals, following the Bork incident.

• If you manage student data or are a government agency, you may be required to protect the confidentiality of user data.

In many other cases, there is likely to be no legal requirement to protect the confidentiality of user data. However, it's probably still the right thing to do.

In Europe, the answers are likely to be very different, as Europe has strong data protection laws that do not have any analogue in US law.

Answer 2

In a certain respect, everyone is required to protect personal information in as much as anyone can be sued for failing to do so. Perhaps unsuccessfully, but a healthy bit of CYA is in order whenever you deal with the litigious masses.

Further, contractual obligations, (especially government contracts) may apply similar restraints, as may your own privacy policy -- which can, of course, be used against you.

Finally, depending on your industry, you may be under further obligation. There's plenty of regulation surrounding banking, for example. And remember the law that makes it illegal to disclose someone's video rental history? All it takes is one embarrassed senator and the legal environment can change in the most unexpected ways.

Answer 3

In general, you may be legally required to conform to:

• any contractual agreements you have in place with customers/suppliers
• regulations/laws relating to the jurisdictions in which the company is incorporated
• regulations/laws relating to the jurisdictions in which the company is operating
• regulations/laws relating to jurisdictions where the people whose data you store live
• regulations/laws relating to your company based on it's industry
• regulations relating to your company based on it's type (e.g. a US public company has responsibilities under SOX)

This is potentially a lot of laws/regulations/contracts; even worse, some of them are vague, some of them are out of date, and some of them may contradict others. You will want to consult a relevant lawyer.