E-Commerce Law Week, Issue 350

Data Protectionism Comes to the US Congress
On April 14, Sen. Clinton and Rep. Markey introduced companion bills that, if enacted, would require American companies to notify customers when they send customers’ personal information to foreign affiliates or subcontractors.  The Safeguarding Americans From Exporting Identification Data Act (SAFE ID Act) -- introduced concurrently as S. 810 and H.R. 1653, although the two bills are slightly different -- requires "business enterprises" to provide consumers with an opportunity to "opt out" of  having their data sent outside the US for processing, and it gives consumers a private right of action to recover damages that result from any misuse of their information if it is transferred to another country in violation of the provisions of the Act.  Sen. Clinton's S. 810 is a broadly written bill -- more so than Rep. Markey's H.R. 1653,  but both manifestations of the SAFE ID Act would be more burdensome on companies than even the EU's strict data transfer laws.

Japanese Data Privacy Law Now In Effect
Visitors to Akihabara, Japan's electronics district, know that the Japanese consumer electronics industry is a few years ahead of the US and Europe, offering local consumers the latest wireless phones, laptops, and gaming consoles before their western counterparts.  And when it comes to comprehensive data privacy and security legislation, Japan has also beaten the US to the punch.  Under a law that went into effect April 1, companies with offices in Japan and that handle the personal information of at least 5,000 individuals (including employees) must follow guidelines implementing the Personal Information Protection Act. The Act establishes privacy protections for the collection, handling, use, and disclosure of personal  information, including taking measures to secure data from unauthorized disclosure or abuse. 

All Online Bets Are On In The UK
Much to the delight of the gaming industry, in April the UK government passed a long-anticipated gambling bill. The Gambling Act 2005 ("Act") updates UK gambling laws dating from the 1960s, and in particular, regulates online gaming, which has become increasingly popular in recent years. Online casino companies will be allowed to operate out of the UK for the first time.  The key protections provided in the Act for online gambling include: (1) a new Gambling Commission ("Commission") with powers to investigate, prosecute, enter premises, seize goods, void bets they consider unfair, levy fines and revoke gambling licenses; (2) a new criminal offence of inviting, permitting or causing a child to gamble offline or online; (3) compulsory age checks by gambling websites operating from the UK, backed up by "mystery shopper" surveys by the Commission; (4) restrictions on the manufacture, supply, installation and adaptation of gambling software, which require a license from the Commission; and (5) listing of social responsibility as an explicit licence condition, with breaches triggering penalties such as unlimited fines or even loss of licence.  It is expected that the Act will be fully implemented by late 2007.

Last Chance to Register:  "Fire Inside the Firewall:  Liability for Information Security Breaches"
Today, information security breaches are in the headlines and in the legislatures -- Congress and the states are looking to establish new information security practices.  Soon, more of these breaches could be in the courts as well, as plaintiffs seek to hold businesses liable for bad security practices.  The prospect of liability is becoming a substantial concern for all businesses that own, license, or process personal information and other computer data.  With that in mind, Steptoe & Johnson LLP is pleased to present a seminar on data security in New York City on May 13.  For more information, please contact Stuart Davis.

Questions and comments about E-Commerce Law Week are always welcome.  Please send your feedback to Sally Albertazzie.