BILL ANALYSIS                                                                                                                                                                                                    ”


          |SENATE RULES COMMITTEE            |                   SB 242|
          |Office of Senate Floor Analyses   |                         |
          |1020 N Street, Suite 524          |                         |
          |(916) 651-1520         Fax: (916) |                         |
          |327-4478                          |                         |
                                 THIRD READING

          Bill No:  SB 242
          Author:   Corbett (D)
          Amended:  5/25/11
          Vote:     21

           SENATE JUDICIARY COMMITTEE  :  3-2, 5/10/11
          AYES:  Evans, Corbett, Leno
          NOES:  Harman, Blakeslee

          SUBJECT  :    Social networking Internet Web sites:  privacy: 

           SOURCE  :     Author

           DIGEST  :    This bill requires social networking Internet 
          Web sites to:  (1) establish a default privacy setting for 
          registered users that prohibits the display of any 
          information about the user without the agreement of the 
          user, as specified; (2) establish a process for new users 
          to set their privacy settings as part of the registration 
          process that explains privacy options in plain language; 
          and (3) remove personal identifying information in a timely 
          manner upon request.  This bill provides that a social 
          networking Internet Web site that willfully and knowingly 
          violates the bill's provisions shall be liable for a civil 
          penalty not to exceed $10,000 for each violation.

           Senate Floor Amendments  of 5/25/11 re-define "in a timely 
          manner" from 48 hours to within 96 hours and narrow the 
          definition of personally identifying information.


                                                                SB 242

           ANALYSIS  :    Existing law provides that, among other 
          rights, all people have an inalienable right to pursue and 
          obtain privacy.  (Cal. Const., art. I, Sec. 1.)

          Existing case law permits a person to bring an action in 
          tort for an invasion of privacy and provides that in order 
          to state a claim for violation of the constitutional right 
          to privacy, a plaintiff must establish the following three 
          elements:  (1) a legally protected privacy interest; (2) a 
          reasonable expectation of privacy in the circumstances; and 
          (3) conduct by the defendant that constitutes a serious 
          invasion of privacy.  (  Hill v. National Collegiate Athletic 
          Assn  . (1994) 7 Cal.4th 1.)  Existing law recognizes four 
          types of activities considered to be an invasion of 
          privacy, giving rise to civil liability including the 
          public disclosure of private facts.  
          Existing case law provides that there is no reasonable 
          expectation of privacy in information posted on an Internet 
          Web site.  The information is no longer a "private fact" 
          that can be protected from public disclosure.  (  Moreno v. 
          Hanford Sentinel  (2009) 172 Cal.App.4th 1125.)

          This bill requires a social networking Internet Web site to 
          establish a default privacy policy setting for all 
          registered users of the site that prohibits the display to 
          the public or other registered users, any information about 
          a registered user, other than the user's name and city of 
          residence, with the express agreement of the user.  

          This bill requires a social networking Internet Web site to 
          establish a process for new users to set their privacy 
          settings as part of the registration process that explains 
          privacy options in plain language.  The site shall not 
          complete the registration process until privacy settings 
          are selected by the user, and the site shall make privacy 
          settings available to all users in a conspicuous place and 
          an easy-to-use format that allow the user to adjust his or 
          her privacy setting.  

          This bill defines "plain language" as a clear explanation, 
          written in easy to understand terms that achieve a minimum 
          Flesch Reading Ease score of 70, as that calculation is 



                                                                SB 242

          described in the California Code of Regulations, as 

          This bill requires a social networking Internet Web site to 
          remove the personal identifying information of a registered 
          user "in a timely manner" upon his or her request.  For 
          registered users that have self-identified as under 18 
          years of age, the social networking internet web site shall 
          remove that information upon the request of a parent of the 
          registered user.  This bill provides that for purposes of 
          this bill "personal identifying information" shall not 
          include a person's name, address, telephone number, 
          driver's license number, social security number, employee 
          identification number, mother's maiden name, demand deposit 
          account number, savings account number, or credit card 
          number.  "Personal identifying information" also means 
          information about a person's current location, including 
          global positioning system coordinates, in different types 
          of media, transmitted to, or over the Internet.  This bill 
          provides that a request submitted by a registered user 
          shall include sufficient information to verify the identity 
          of the user and shall specify any known location of the 
          information that is the subject of the request.

          This bill defines "in a timely manner" to mean within 96 
          hours of the request.  

          This bill provides that a social networking site that 
          willfully and knowingly violates any provision of this part 
          shall be liable for a civil penalty, not to exceed $10,000 
          for each violation of the bill.

          This bill defines "social networking internet web site" as 
          an Internet Web based service that allows individuals to 
          construct a public or partly public profile within a 
          bounded system, articulate a list of other users with whom 
          they share a connection, and view and traverse their list 
          of connections and those made by others within the system.  
          This bill also defines "registered user" and "personally 
          identifying information."

           FISCAL EFFECT  :    Appropriation:  No   Fiscal Com.:  No   
          Local:  No



                                                                SB 242

           SUPPORT  :   (Verified  5/25/11)

          California Alliance of Retired Americans
          California State Sheriffs' Association
          Child Abuse Prevention Council
          Consumer Watchdog
          Crime Victims Untied
          Peace Officer Research Association of California

           OPPOSITION  :    (Verified  5/25/11)

          Internet Alliance
          Tech America

           ARGUMENTS IN SUPPORT  :    According to the author's office, 
          computers systems and the Internet have brought consumers 
          many conveniences.  Sites like Facebook and Twitter provide 
          users with a place to share personal information with 
          friends, family, and the public an activity that's proven 
          to be hugely compelling to Internet users. In response to 
          the demand, technology is evolving to encourage the 
          disclosure of information that was formerly discreet (like 
          location), and to enable the sharing of information even 
          when not sitting in front of a traditional computer (like 
          from mobile phones).

          But these innovative methods of information sharing can 
          pose a serious threat to our privacy and security.  There 
          are countless privacy pitfalls when our personal 
          identifying information is indiscriminately posted, 
          indefinitely stored, and quietly collected and analyzed by 
          marketers, and identity thieves.

          Current law does not require social networking websites to 
          provide a mechanism for users to adjust their privacy 
          settings, or remove their personal identifying information; 
          nor does it govern the disclosure of users' personal 
          information to third parties and the public.

           ARGUMENTS IN OPPOSITION  :    The Internet Alliance (IA), in 
          opposition, notes that the bill "does not stipulate that 
          the person provide a specific description of the 
          information to be removed or its location. Without that 



                                                                SB 242

          information, social networking sites especially would not 
          know what information to look for, a problem that gets more 
          complicated when many users share the same basic 
          biographical information. For example, there may be 100 
          John Smiths in the United States.  Moreover, social 
          networks do not currently have the technology to delete a 
          customer's information from an entire site."  While the 
          above amendment would address the situation where a user 
          requests the removal of a common name from the social 
          networking site, it would not address issues relating to 
          specificity of the request.  In an effort to address those 
          issues, the author offers the following amendment to 
          require the registered user to verify his or her identity 
          and to specify any known location of that information.

          The IA, in opposition, contends that this bill "would force 
          users to make decisions about privacy and visibility of all 
          information, well before they have even used the service 
          for the first time, and in such a manner that they are less 
          likely to pay attention and process the information than 
          they are today."  IA further contends that this bill is 
          moving in the opposite direction urged by the FTC in their 
          proposed privacy framework, that the bill singles out 
          social networks, that major social networks already remove 
          personal information upon request under certain 
          circumstances, and that, if the bill is enacted and 
          challenged, a court could award attorneys' fees for the 
          plaintiff if this statute is found unconstitutional.

          TechNet echoes similar concerns and argues that this bill 
          would do significant damage to California's technology 
          sector by "drastically limit›ing] social networking sites' 
          growth potential in California by imposing additional 
          operating costs and raising barriers to consumer 
          participation in social networking services, all while 
          exposing those services to massive and unwarranted civil 
          liability and in turn, creating significant confusion and 
          uncertainty for investors, businesses and consumers."

          RJG:do  5/26/11   Senate Floor Analyses 

                         SUPPORT/OPPOSITION:  SEE ABOVE



                                                                SB 242

                                ****  END  ****