BILL ANALYSIS �
SENATE JUDICIARY COMMITTEE
Senator Noreen Evans, Chair
2013-2014 Regular Session
SB 501 (Corbett)
As Amended April 15, 2013
Hearing Date: April 23, 2013
Fiscal: No
Urgency: No
TH
SUBJECT
Social Networking Internet Web sites: Privacy: Minors
DESCRIPTION
This bill would require social networking Web sites to remove
the address, telephone number, and other personal identifying
information of a registered user within 96 hours of his or her
request. It would also allow a parent or legal guardian of a
registered user who identifies himself or herself as under 18
years of age to require a social networking Web site to remove
personal identifying information of their children.
This bill would provide that a social networking Web site that
willfully and knowingly violates the bill's provisions shall be
liable for a civil penalty not to exceed $10,000 for each
violation.
BACKGROUND
Social networking Internet Web sites such as MySpace and
Facebook have grown in use and become more popular with users
who post messages and photos on a personal web page. Those
personal pages, generated by the social networking Web site, may
also display the user's address, phone number, birth date, or
other personal identifying information. That information may
then be displayed to the user's friends or to the general
public. Although users may limit who may see their personal
information, many users, including those under the age of 18,
often share that information with their "friends." The list of
"friends" for those users may include people who they do not
(more)
SB 501 (Corbett)
PageB of?
personally know, resulting in the sharing of personal
identifying information with unknown persons.
Children under the age of 18 are among the most avid users of
social networking Internet Web sites. A report by the Pew
Foundation entitled Social Media & Mobile Internet Use Among
Teens and Young Adults (February 2010) found that 93 percent of
American teens between the ages of 12 and 17 are online, and
that 73 percent of these teens use social networking sites.
(See http://www.pewinternet.org/Reports/
2010/Social-Media-and-Young-Adults.aspx, as of April 20, 2013.)
A 2005 survey by the Polly Klaas Foundation found that 42
percent of online teens post information about themselves on the
Internet so others can contact them, and 56 percent have been
asked personal questions online. (Polly Klass Foundation,
Omnibuzz Research Poll Results,
http://www.pollyklaas.org/internet-safety/internet-pdfs/PollingSu
mmary.pdf, as of April 20, 2013.) Additionally, 10 percent of
children aged 8-12 surveyed said they communicate online with
people they don't know. (See id.)
Many research organizations have found that the sharing of
personal identifying information through social networking
Internet Web sites poses a significant threat to personal
privacy. A 2010 Consumer Reports survey found that
Many social network users are naive about risks. Forty
percent had posted their full birth date, exposing them to
identity theft. Twenty-six percent of Facebook users with
children had potentially exposed them to predators by
posting the children's photos and names. And in one of
four households with a Facebook account, users weren't
aware of or didn't choose to use the service's privacy
controls. (Consumer Reports, Social insecurity: What
millions of online users don't know can hurt them,
http://www.consumerreports.org/cro/magazine-archive/2010/jun
e/ electronics-computers/social-insecurity/overview/
index.htm, as of April 20, 2013.)
Social network users under the age of 18 are particularly at
risk. According to the American Academy of Pediatrics (AAP),
"[t]he main risk to preadolescents and adolescents online today
are risks from each other, risks of improper use of technology,
lack of privacy, sharing too much information, or posting false
information about themselves or others." (AAP, The Impact of
SB 501 (Corbett)
PageC of?
Social Media on Children, Adolescents, and Families,
http://pediatrics.aappublications.org/content/127/4/800.full, as
of April 20, 2013.) "These types of behavior," according to the
AAP, "put [minors'] privacy at risk." (Id.)
In response to concerns about the sharing and dissemination of
personal information on the Internet, particularly by minor
children, this bill would require social networking Internet Web
sites to remove a user's personal identifying information, upon
request, within 96 hours. This bill would also allow parents or
legal guardians of a registered user who identifies himself or
herself as being under 18 years of age to request the removal of
their minor child's personal identifying information.
CHANGES TO EXISTING LAW
Existing law provides that, among other rights, all people have
an inalienable right to pursue and obtain privacy. (Cal.
Const., art. I, Sec. 1.)
Existing case law permits a person to bring an action in tort
for an invasion of privacy and provides that in order to state a
claim for violation of the constitutional right to privacy, a
plaintiff must establish the following three elements: (1) a
legally protected privacy interest; (2) a reasonable expectation
of privacy in the circumstances; and (3) conduct by the
defendant that constitutes a serious invasion of privacy. (Hill
v. National Collegiate Athletic Assn. (1994) 7 Cal.4th 1.)
Existing law recognizes four types of activities considered to
be an invasion of privacy giving rise to civil liability,
including the public disclosure of private facts. (Id.)
Existing case law provides that there is no reasonable
expectation of privacy in information posted on an Internet Web
site. The information is no longer a "private fact" that can be
protected from public disclosure. (Moreno v. Hanford Sentinel
(2009) 172 Cal.App.4th 1125.)
Existing federal law makes it unlawful for an operator of a Web
site or online service directed to children under the age of 13
to collect personal information from a child, including a
child's first and last name, home or other physical address
including street name and name of a city or town, e-mail
address, telephone number, or Social Security number. (Child
Online Privacy Protection Act, 15 U.S.C. Sec. 6501 et. seq.)
SB 501 (Corbett)
PageD of?
Existing law requires an operator of a commercial Web site or
online service that collects personally identifiable information
through the Internet about individual consumers residing in
California who use or visit its Web site to conspicuously post
its privacy policy. (Online Privacy Protection Act of 2003, Bus
& Prof Code Sec. 22575.)
This bill would require a social networking Internet Web site to
remove personal identifying information of a registered user,
upon request, within 96 hours of delivery of the request.
This bill would permit a parent or legal guardian of a
registered user who identifies himself or herself as being under
18 years of age to require a social networking Internet Web site
to remove their minor child's personal identifying information.
This bill would provide that a social networking Internet Web
site that willfully and knowingly violates the above prohibition
is liable for a civil penalty of up to $10,000 for each
violation.
This bill would define "social networking Internet Web site" as
an Internet Web-based service that allows an individual to
construct a public or partly public profile within a bounded
system, articulate a list of other users with whom the
individual shares a connection, and view and traverse his or her
list of connections and those made by others in the system.
This bill would define "personally identifying information" as a
person's address, telephone number, driver's license number,
state identification card number, social security number,
employee identification number, mother's maiden name, demand
deposit account number, savings account number, or credit card
number.
This bill would define "registered user" as any person who has
created an account for purposes of accessing a social networking
Internet Web site.
COMMENT
1. Stated need for the bill
According to the author,
SB 501 (Corbett)
PageE of?
Computer systems and the Internet have brought consumers
many conveniences. But these innovative methods of
information sharing can pose a serious threat to our
privacy and security. There are countless privacy pitfalls
when our personal identifying information is
indiscriminately posted.
Current law does not require a social networking Web site
to honor a user's request or, in the case of a minor user
under the age of 18, a parent or legal guardian's request
to remove certain personally identifiable information
(address, telephone number, driver's license number, state
identification card number, social security number,
employee identification number, mother's maiden name,
demand deposit account number, savings account number, or
credit card number).
The author also notes that the included penalty only applies to
those social networking Internet Web sites that "willfully and
knowingly" violate the prohibition, thus, the penalty would not
apply to Web sites in cases where the user misrepresents his or
her age in gaining access to the site.
2. Protection of personal information
Staff notes that the right to privacy is a fundamental right
protected by Section 1 of Article I of the Constitution of
California. This bill builds upon that fundamental right by
requiring social networking Internet Web sites to remove a
registered user's personal identifying information upon request.
Social networking Internet Web sites offer people extensive
opportunities to interact and share information with other
individuals online. However, unfamiliarity with a particular
Web site or confusion about how information will be displayed
across a social network could lead to the unwanted dissemination
of personal information. A study by Columbia University
entitled The Failure of Online Social Network Privacy Settings
found that 93.8 percent of participants revealed information
that they intended to keep private, and that 84.6 percent of
participants were hiding information that they actually wanted
to share. (http://
academiccommons.columbia.edu/catalog/ac:135406, as of April 20,
2013.) As recent as 2010, 83 percent of adults surveyed
nationwide said they were more concerned about online privacy
SB 501 (Corbett)
PageF of?
today than they were five years ago. (Common Sense Media,
Common Sense Media Poll,
http://www.commonsensemedia.org/sites/default/files/
privacypoll.pdf, as of April 20, 2013.) When asked about the
privacy of children online, the same survey found that 92
percent of parents were concerned that their children shared too
much information online, and three quarters of parents (75
percent) didn't think social networking sites did a good job of
protecting children's online privacy. (Id.)
To address privacy concerns regarding the potential unwanted
dissemination of personal identifying information across the
Internet, this bill would give registered users of social
networking Internet Web sites a statutory tool to require the
removal of personal identifying information upon request. From
a public policy standpoint, having an effective method to
protect sensitive information from disclosure on the Internet
is especially important due to the ability of that information,
once it becomes publically available, to be rapidly distributed.
Since there are Web sites that archive web pages as of a
certain date and time, such as www.archive.org, it is possible
that a user's inadvertent disclosure of his or her personal
information may be "cached" and saved indefinitely on another
Web site. Given those serious privacy issues, having the
ability to require a social networking Internet Web site to
quickly remove personal identifying information is critical to
protecting California consumers. Equipping consumers with a
statutory mechanism to require the removal of personal
identifying information from social networking Internet Web
sites would further the Legislature's longstanding policy of
providing effective laws to protect individual privacy. As the
California State Sheriffs' Association states in support of the
bill, "[t]he ability to request the removal of this personal
identifying information from a social networking website allows
a user to protect themselves, and in the case of a user who is a
minor, would provide a parent or legal guardian with a tool to
protect their children."
3. Location of personal identifying information
Parties opposed to prior legislation on this subject had
expressed concern over potential difficulties in locating
material responsive to a registered user's removal request,
noting that responsive material may be distributed across a
social networking Internet Web site. Further, in some cases the
SB 501 (Corbett)
PageG of?
personal identifying information of certain users may overlap,
as with roommates who share an address, or family members who
share a telephone number. Consequently, the parties expressed
concern that discerning what personal identifying information
would be subject to a specific registered user's removal request
may be difficult without more detailed localizing information,
and this difficulty could potentially expose a social networking
Internet Web site to unreasonable civil liability.
Staff notes that this bill directly addresses these concerns,
and mitigates the potential for unwarranted civil liability in
two ways. First, a registered user submitting a removal request
must "specify any known location of the information that is the
subject of the request." (See SB 501, page 2, lines 18-19.)
This requirement largely relieves a social networking Internet
Web site of the burden to search for and identify Web site
content responsive to a request. Though not addressed in the
bill, staff notes that most social networking Internet Web sites
already have some sort of system where users can flag
inappropriate content for review and possible removal by a
system administrator. It may be possible to integrate a
function to allow registered users to submit removal requests
alongside this existing flagging functionality. Second, this
bill's civil penalty provision is limited to violations that are
"willfully and knowingly" committed by the operator of a social
networking Internet Web site. Liability for civil penalties
would arguably not attach in situations where a social
networking Internet Web site failed to remove material
responsive to a registered user's request that the operator of
the Web site was not aware of.
4. Verification of party requesting removal
Opponents of the bill highlight the fact that, as currently
drafted, this bill lacks any provision for guaranteeing that
individuals who submit removal requests actually have the lawful
authority to submit such a request. The California Chamber of
Commerce asserts that "[n]o business should be put in the
position of figuring out who is the parent or guardian with the
authority to remove content from a minor's account," and that
"this bill places operators of social media sites in a perilous
position" and increases their exposure to civil litigation. It
is important to note that existing law already requires social
network Internet Web sites to act on requests submitted by users
to remove certain materials in other contexts without first
SB 501 (Corbett)
PageH of?
verifying their identity, or their lawful authority to submit
the request. For example, the Digital Millennium Copyright Act
of 1998 ("DMCA"), 17 U.S.C. Sec. 512, et. seq., requires
Internet Web site operators to remove allegedly copyright
infringing materials from their Web sites upon request without
first verifying that the requesting party is the lawful holder
of the copyright in question.
Staff notes that the opposition's concerns may be addressed, in
part, if the bill were amended to specifically allow operators
to require an affirmation from persons requesting the removal
which states that the requester has the authority to submit such
a request. Similar affirmations are routinely required of users
who request the removal of allegedly copyright infringing
material under the DMCA. As a result, the author should
consider the following amendment:
On page 2, after line 19, insert:
(c) A social networking Internet Web site may require a
request submitted by a registered user pursuant to
subdivision (a) to include the following statement: "I
attest that the information in this request is accurate,
that I am the registered user or the parent or legal
guardian of the registered user to whom the personal
identifying information in this request pertains, and that
I am authorized to make this request under the laws of the
State of California."
5. Free speech rights of minors
The California Chamber of Commerce, writing in opposition,
asserts, "this bill could give parents access to a 17-year-old's
content and could possibly infringe on their rights to privacy
and speech." Generally speaking, the First Amendment to the
U.S. Constitution, and Article 1 of the California Constitution,
act to protect the freedom of expression of the citizens of
California. The determination about whether a specific statute
inappropriately restricts speech requires an examination of
whether it is content-based or content-neutral, is unduly vague
or overbroad, and whether the restriction acts as a
prior-restraint on speech. Laws that are content-based, vague,
or act as a prior-restraint are strongly disfavored by the
courts. In Police Department of Chicago v. Mosley, the U.S.
SB 501 (Corbett)
PageI of?
Supreme Court stated that:
[A]bove all else, the First Amendment means that government
has no power to restrict expression because of its message,
its ideas, its subject matter, or its content. To permit
the continued building of our politics and culture, and to
assure self-fulfillment for each individual, our people are
guaranteed the right to express any thought, free from
government censorship. The essence of this forbidden
censorship is content control. Any restriction on
expressive activity because of its content would completely
undercut the profound national commitment to the principle
that debate on public issues should be uninhibited, robust,
and wide-open. (Police Dep't of Chicago v. Mosley (1972)
408 U.S. 92, 95-96 (citations and quotation marks
omitted).)
Minors are afforded a similar freedom of speech and expression
under the First Amendment to that given adults, but their rights
may be curtailed in certain instances. The Supreme Court, for
example, has declared, "it can hardly be argued that either
students or teachers shed their constitutional rights to freedom
of speech and expression at the schoolhouse gate." (Tinker v.
Des Moines Independent Sch. Dist. (1969) 393 U.S. 503, 506.)
However, at least in the context of public schools, the Court
has held that "the constitutional rights of students . . . are
not automatically coextensive with the rights of adults in other
settings." (Bethel Sch. Dist. v. Fraser (1986) 478 U.S. 675,
683.) Similarly, the Court has held that states may proscribe
the sale of indecent materials to minors in a way inapplicable
to adults (Ginsberg v. State of N. Y. (1968) 390 U.S. 629), and
can limit the broadcasting of indecent speech at times when
children are likely to be watching or listening (F.C.C. v.
Pacifica Foundation (1978) 438 U.S. 726, 730).
In Ginsberg, the Court noted that "[t]he well-being of its
children is of course a subject within the State's
constitutional power to regulate." (Ginsberg v. State of N. Y.,
390 U.S. at 639.) Limitations placed upon a minor's rights of
speech and expression are based upon two interests. First,
"constitutional interpretation has consistently recognized that
the parents' claim to authority in their own household to direct
the rearing of their children is basic in the structure of our
society," and "parents and others . . . who have this primary
responsibility for children's well-being are entitled to the
SB 501 (Corbett)
PageJ of?
support of laws designed to aid discharge of that
responsibility." (Id.) Second, "[t]he State also has an
independent interest in the well-being of its youth," and that
interest includes enacting measures "to protect the welfare of
children and to see that they are safeguarded from abuses which
might prevent their growth into free and independent
well-developed men and citizens." (Id. at 640-41.)
While it is settled law that minors enjoy diminished
constitutional freedoms as compared to adults, particularly
where those freedoms clash with the innate right of parents to
raise their children as they see fit, the precise boundary
between a minor's right of expression on the Internet and a
parent's parental right to shape and restrict that expression
remains ill defined. From a public policy standpoint, it is
unclear why children and young adults would have an
expression-based need to disclose their personal identifying
information as defined in the bill on social networking Internet
Web sites against the wishes of their parents or legal
guardians, particularly in light of the prevalent threat of
identity theft on the Internet. That is not to say, however,
that a minor would always be without an expression-based reason
for wanting to disclose this information. For example, it is
possible that a minor may want to disclose his or her home
address as part of a socioeconomic critique about where they
live in relation to others. Whether a minor's right to speech
and expression would yield to a parent's desire to preserve
their child's privacy interests in such a case remains an open
question.
6. Impact on third parties
The California Chamber of Commerce also argues that this bill,
as drafted, might interfere with the free speech rights of third
parties. They argue:
This bill would permit a user or parent of a minor to
delete a person's content, even in places where someone
else has shared the information. If a person is tagged in
a picture at their home and shared by a grandparent,
relative, or other individual, that would be subject to
removal under this bill.
The opposition further argues:
SB 501 (Corbett)
PageK of?
From a technology standpoint, this bill is virtually
impossible to implement. Anyone can cut and paste or
upload/download another person's content making the
original source of the content more difficult to determine.
Many websites are built in a similar manner of sharing
content across many different platforms and sites, making
it that more difficult to determine the origination point
of the material.
As discussed above, third parties are guaranteed the right to
free speech and expression under both the U.S. and California
Constitutions. Unlike the case of minors, the rights of third
parties are generally not curtailed in the interests of others
(with some notable exceptions).<1> Although the range of speech
interests involving the information defined as "personal
identifying information" in this bill is arguably narrow, its
compelled removal could potentially limit the free expression of
individuals on social networking sites, including Facebook which
was recently credited as playing an important role in the
organization of the 2011 revolution in Egypt. Staff notes that
such an analysis is fact specific and ultimately for the courts.
7. Data preservation for law enforcement activities
Staff notes that in certain situations an operator of a social
networking Internet Web site may be prohibited from removing the
personal identifying information of a registered user when that
information is part of a law enforcement action. Under the
Stored Communications Act of 1986, 18 U.S.C. Sec. 2701, et.
seq., a valid subpoena issued in connection with an official
criminal investigation or an order from a court of competent
jurisdiction may compel a Web site operator to preserve or
disclose personal identifying information, such as a credit card
number, to law enforcement authorities irrespective of a
registered user's request that such information be removed from
a Web site. To eliminate the possibility of a conflict between
the provisions of this bill and existing law pertaining to data
preservation and disclosure in law enforcement cases, the author
should consider the following amendment:
---------------------------
<1> It should also be noted that California allows victims of
domestic violence, individuals associated with witness
protection, and reproductive health care providers, to request
the removal of specified personal information from an Internet
Web site.
SB 501 (Corbett)
PageL of?
On page 2, after line 19, insert:
(d) An operator of a social networking Internet Web site is
not required to remove or otherwise eliminate personal
identifying information when any other provision of federal
or state law requires the operator to maintain the
information.
(e) This section shall not be construed to limit the
authority of a law enforcement agency to obtain any content
or information from an operator as authorized by law or
pursuant to an order of a court of competent jurisdiction.
8. Length of time to comply with removal request
This bill would require a social networking Internet Web site to
remove the personal identifying information of a registered user
upon request "in a timely manner," which the bill defines as
"within 96 hours of delivery of the request." (See SB 501, page
2, lines 21-22.) The California Chamber of Commerce, writing in
opposition, characterizes this time restriction as "unworkable"
because "[a]ll sites are not monitored [on a] 24 hour basis."
The opposition offers no explanation for why the lack of 24 hour
monitoring of certain Web sites would preclude a social
networking Internet Web site operator from acting on a removal
request within 96 hours (which is four consecutive 24 hour
periods).
Support : Alameda County Sheriff's Office; Peace Officers
Research Association of California; California State Sheriff's
Association; Crime Victims United of California
Opposition : California Chamber of Commerce; TechNet; Electronic
Frontier Foundation
HISTORY
Source : Author
Related Pending Legislation :
AB 1291 (Lowenthal) would create the Right to Know act of 2013,
repealing and reorganizing certain provisions of existing law
pertaining to the disclosure of a consumer's personal
SB 501 (Corbett)
PageM of?
information. This bill is in the Assembly Judiciary Committee.
SB 568 (Steinberg) would prohibit an operator of an Internet Web
site, online service, online application, or mobile application,
from marketing or advertising a product or service to a minor if
the minor cannot legally purchase the product or participate in
the service in the State of California. This bill would also
prohibit an operator from using, disclosing, or compiling, or
allowing a third party to knowingly use, disclose, or compile,
the personal information of a minor for the purpose of marketing
goods or services that minors cannot legally purchase or engage
in the State of California. This bill is in the Senate
Judiciary Committee.
Prior Legislation :
ACR 106 (Nava, 2008), would have urged user-generated content
Web sites to work with the Safety Technical Task Force and law
enforcement to reduce the use of those Web sites for purposes of
criminal behavior. This resolution died on the Assembly Floor.
SB 632 (Davis, 2009), would have required a social networking
Internet Web site to provide a disclosure to users that an image
which is uploaded onto the Web site is capable of being copied,
without consent, by persons who view the image, or copied in
violation of the privacy policy, terms of use, or other policy
of the site. This bill was vetoed.
SB 1361 (Corbett, 2010), would have prohibited a social
networking Internet Web site, as defined, from displaying, to
the public or other registered users, the home address or
telephone number of a registered user of that Internet Web site
who is under 18 years of age, as provided. This bill failed
passage in the Assembly Arts, Entertainment, Sports, Tourism,
and Internet Media Committee.
SB 242 (Corbett, 2011), would have prohibited a social
networking Internet Web site from displaying the home address or
telephone number, in specified text fields, of a registered user
who identifies himself or herself as under 18 years of age.
This bill failed passage on the Senate floor.
SB 761 (Lowenthal, 2012), would have required the Attorney
General, by July 1, 2012, to adopt regulations that would
require online businesses to provide California consumers with a
SB 501 (Corbett)
PageN of?
method for the consumer to opt out of the collection or use of
his or her information by the business. This bill died in the
Senate Appropriations Committee.
**************