1

I was one of the developers of a web form that we built for a client (USA based) some 2 years back. Today, we received an email from them stating that one of their customers raised a concern with them about our web form not being secure and breaching privacy laws.

Now I understand this sounds very ambiguous and hence we have replied back to them asking for more clarity on the issue. While we await their response, I thought of posting this here so that I can at least be ready to respond to their queries.

I think the secure part of the concern is related to not using SSL. But I'm not quite sure about the breaching privacy laws part. In your experience, what could this mean?

PS: The web form in question collects personal information like

  • Name
  • Email Address
  • Postal Address
  • Phone Number

And some business related information like

  • Transaction Number
  • Claim Number

There is no sensitive information collected such as CC Number, SSN, Bank Account details etc. The form is validated both client side as well as server side.

closed as primarily opinion-based by user45139, Deer Hunter, Stephane, Neil Smithline, schroeder Oct 28 '15 at 14:51

Many good questions generate some degree of opinion based on expert experience, but answers to this question will tend to be almost entirely based on opinions, rather than facts, references, or specific expertise. If this question can be reworded to fit the rules in the help center, please edit the question.

  • 4
    This question looks like it could be better served at Law.SE – timuzhti Oct 28 '15 at 6:38
  • Please let us know the updates once you receive the email – Ulkoma Oct 28 '15 at 11:41
  • We, like you, can only guess. You need the feedback from your client. – schroeder Oct 28 '15 at 14:50
  • Probably someone just blowing smoke to try and get attention. The information listed is PII though, and could certainly be used to initiate social engineering attacks (do the kids still call it that?). – Dave Oct 29 '15 at 21:23
2

As you said, you require personal information, transferred over a public internet connection. Anyone may get to know that this specific user had an interaction with the website, plus some of his personal data.

IANAL, but depending on the jurisdiction of the client's customer, this may well break some privacy law. Especially here in Europe we have quite a strict view about that.

Not the answer you're looking for? Browse other questions tagged or ask your own question.