I was one of the developers of a web form that we built for a client (USA based) some 2 years back. Today, we received an email from them stating that one of their customers raised a concern with them about our web form not being secure and breaching privacy laws.
Now I understand this sounds very ambiguous and hence we have replied back to them asking for more clarity on the issue. While we await their response, I thought of posting this here so that I can at least be ready to respond to their queries.
I think the secure part of the concern is related to not using SSL. But I'm not quite sure about the breaching privacy laws part. In your experience, what could this mean?
PS: The web form in question collects personal information like
- Email Address
- Postal Address
- Phone Number
And some business related information like
- Transaction Number
- Claim Number
There is no sensitive information collected such as CC Number, SSN, Bank Account details etc. The form is validated both client side as well as server side.