BILL ANALYSIS Ó ------------------------------------------------------------ |SENATE RULES COMMITTEE | SB 242| |Office of Senate Floor Analyses | | |1020 N Street, Suite 524 | | |(916) 651-1520 Fax: (916) | | |327-4478 | | ------------------------------------------------------------ THIRD READING Bill No: SB 242 Author: Corbett (D) Amended: 5/17/11 Vote: 21 SENATE JUDICIARY COMMITTEE : 3-2, 5/10/11 AYES: Evans, Corbett, Leno NOES: Harman, Blakeslee SUBJECT : Social networking Internet Web sites: privacy: minors SOURCE : Author DIGEST : This bill requires social networking Internet Web sites to: (1) establish a default privacy setting for registered users that prohibits the display of any information about the user without the agreement of the user, as specified; (2) establish a process for new users to set their privacy settings as part of the registration process that explains privacy options in plain language; and (3) remove personal identifying information in a timely manner upon request. This bill provides that a social networking Internet Web site that willfully and knowingly violates the bill's provisions shall be liable for a civil penalty not to exceed $10,000 for each violation. ANALYSIS : Existing law provides that, among other rights, all people have an inalienable right to pursue and obtain privacy. (Cal. Const., art. I, Sec. 1.) CONTINUED SB 242 Page 2 Existing case law permits a person to bring an action in tort for an invasion of privacy and provides that in order to state a claim for violation of the constitutional right to privacy, a plaintiff must establish the following three elements: (1) a legally protected privacy interest; (2) a reasonable expectation of privacy in the circumstances; and (3) conduct by the defendant that constitutes a serious invasion of privacy. ( Hill v. National Collegiate Athletic Assn . (1994) 7 Cal.4th 1.) Existing law recognizes four types of activities considered to be an invasion of privacy, giving rise to civil liability including the public disclosure of private facts. Existing case law provides that there is no reasonable expectation of privacy in information posted on an Internet Web site. The information is no longer a "private fact" that can be protected from public disclosure. ( Moreno v. Hanford Sentinel (2009) 172 Cal.App.4th 1125.) This bill requires a social networking Internet Web site to establish a default privacy policy setting for all registered users of the site that prohibits the display to the public or other registered users, any information about a registered user, other than the user's name and city of residence, with the express agreement of the user. This bill requires a social networking Internet Web site to establish a process for new users to set their privacy settings as part of the registration process that explains privacy options in plain language. The site shall not complete the registration process until privacy settings are selected by the user, and the site shall make privacy settings available to all users in a conspicuous place and an easy-to-use format that allow the user to adjust his or her privacy setting. This bill defines "plain language" as a clear explanation, written in easy to understand terms that achieve a minimum Flesch Reading Ease score of 70, as that calculation is described in the California Code of Regulations, as specified. This bill requires a social networking Internet Web site to CONTINUED SB 242 Page 3 remove the personal identifying information of a registered user "in a timely manner" upon his or her request. For registered users that have self-identified as under 18 years of age, the social networking internet web site shall remove that information upon the request of a parent of the registered user. This bill provides that for purposes of this bill "personal identifying information" shall not include a person's name. This bill provides that a request submitted by a registered user shall include sufficient information to verify the identity of the user and shall specify any known location of the information that is the subject of the request. This bill defines "in a timely manner" to mean within 48 hours of the request. This bill provides that a social networking site that willfully and knowingly violates any provision of this part shall be liable for a civil penalty, not to exceed $10,000 for each violation of the bill. This bill defines "social networking internet web site" as an Internet Web based service that allows individuals to construct a public or partly public profile within a bounded system, articulate a list of other users with whom they share a connection, and view and traverse their list of connections and those made by others within the system. This bill also defines "registered user" and "personally identifying information." FISCAL EFFECT : Appropriation: No Fiscal Com.: No Local: No SUPPORT : (Verified 5/17/11) California State Sheriffs' Association OPPOSITION : (Verified 5/17/11) Internet Alliance Tech America TechNet ARGUMENTS IN SUPPORT : According to the author's office, CONTINUED SB 242 Page 4 computers systems and the Internet have brought consumers many conveniences. Sites like Facebook and Twitter provide users with a place to share personal information with friends, family, and the public an activity that's proven to be hugely compelling to Internet users. In response to the demand, technology is evolving to encourage the disclosure of information that was formerly discreet (like location), and to enable the sharing of information even when not sitting in front of a traditional computer (like from mobile phones). But these innovative methods of information sharing can pose a serious threat to our privacy and security. There are countless privacy pitfalls when our personal identifying information is indiscriminately posted, indefinitely stored, and quietly collected and analyzed by marketers, and identity thieves. Current law does not require social networking websites to provide a mechanism for users to adjust their privacy settings, or remove their personal identifying information; nor does it govern the disclosure of users' personal information to third parties and the public. ARGUMENTS IN OPPOSITION : The Internet Alliance (IA), in opposition, notes that the bill "does not stipulate that the person provide a specific description of the information to be removed or its location. Without that information, social networking sites especially would not know what information to look for, a problem that gets more complicated when many users share the same basic biographical information. For example, there may be 100 John Smiths in the United States. Moreover, social networks do not currently have the technology to delete a customer's information from an entire site." While the above amendment would address the situation where a user requests the removal of a common name from the social networking site, it would not address issues relating to specificity of the request. In an effort to address those issues, the author offers the following amendment to require the registered user to verify his or her identity and to specify any known location of that information. The IA, in opposition, contends that this bill "would force CONTINUED SB 242 Page 5 users to make decisions about privacy and visibility of all information, well before they have even used the service for the first time, and in such a manner that they are less likely to pay attention and process the information than they are today." IA further contends that this bill is moving in the opposite direction urged by the FTC in their proposed privacy framework, that the bill singles out social networks, that major social networks already remove personal information upon request under certain circumstances, and that, if the bill is enacted and challenged, a court could award attorneys' fees for the plaintiff if this statute is found unconstitutional. TechNet echoes similar concerns and argues that this bill would do significant damage to California's technology sector by "drastically limitÝing] social networking sites' growth potential in California by imposing additional operating costs and raising barriers to consumer participation in social networking services, all while exposing those services to massive and unwarranted civil liability and in turn, creating significant confusion and uncertainty for investors, businesses and consumers." RJG:do 5/17/11 Senate Floor Analyses SUPPORT/OPPOSITION: SEE ABOVE **** END **** CONTINUED