As a multiple website owner and WordPress front-end developer, I am passionate about website security and privacy practices, and the applications and requirements as a modern web developer. I have come to learn that just because you can do something, doesn’t mean that you should. Care must be given to the type of information stored, where it is stored, and how it is transmitted through the interwebs, the resulting consequences range from moderate to severe, but most are avoidable through a little bit of old-fashioned research and prevention.
I am not a lawyer, but I do have many years of practical website building experience, so I would encourage you to discuss your specific concerns with a lawyer. I am going to explain several privacy related topics in a very general way, but in hopes that your interest may be piqued to learn more about each and how they are applicable to you and your website. This is by no means a comprehensive guide, however, more intended as an overview of several general areas of concern. I would like to share my experience with you in hopes that you will avoid the consequences of being naive when it comes to compliance and laws governing transactions that include sensitive information.
I was once asked by a medical professional if I could collect data so that people could fill out their medical information online prior to their visit. Sounds like reasonable request, right? There has always been a way to interact with web information via web form, even before CSS was invented, so the technology was there to store and report on the information. The doctor wanted to collect name, physical and email address, medical information, payment/insurance information and make this easily accessible to the patient via a web interface. Unfortunately, I could not do this, not that it wasn’t technologically possible, but there were specific legal issues that must be considered when accepting and storing sensitive information.
One of the issues here was that the Health Insurance Portability and Accountability Act laws known as (HIPAA Compliance) would govern security practices for anyone collecting sensitive personal medical information together along with identifying personal information. This includes all online transactions, and requires the storage and transmissions of sensitive information be encrypted and that security practices are followed with prompt reporting of major security breaches.
Yet another entire set of laws, collectively known as PCI Compliance or Payment Card Industry Data Standard, would apply in this particular instance, as they were wanting to collect credit card information for settling of accounts. Their intention was to store the credit card information on standard web servers, for the simple reason that they were unaware of the security requirements for working with Payment Cards. Similar to HIPAA, all credit card transactions and information must be stored and transmitted in a secure manner, such as through the use of encryption, which encodes information using advanced algorithms and a private key so that it is unreadable.
Since the client was on a very modest budget, and did not want the burden and expense of maintaining sensitive information, we opted for downloadable PDFs that could be printed and brought to the office with the patient on their visit. For online payments, we set up a PayPal button that would redirect the user to PayPal’s secure website, where all transactions are performed and information is stored on their PCI compliant system.
Another requirement of the medical website involved the collection of email addresses for the purposes of marketing health classes and selling products such as supplements. At this point, the CAN-SPAM Act of 2003 also came into play. In simple terms, they could not harvest all their clients’ emails from their medical records into a marketing list without first obtaining their consent. I recommended that they use a double-opt in process such as those offered by Mailchimp or Constant Contact, that would provide an initial signup form and then an email verification link to confirm the subscription.
If you are an individual or business entity, you could face hefty criminal as well as civil penalties for violations in any of these areas, as well as damage the reputation and credibility of yourself and/or your entire company. Legal compliance in all of these areas must be adhered to and implemented from the start, and ignorance of the law is never an acceptable defense for avoiding compliance with the law. I hope this article has provided you with some information that you can take into account when building/maintaining your own site and that you carefully consider the privacy and security of the information that you are storing to avoid expensive penalties and consequences, especially in the areas of email collection, personal medical information and credit card data.
—
Still very relevant info, and something we’ll all run in to as we work on the web.
However, it should be noted that adding existing customers to a marketing email is not against CAN-SPAM Act of 2003. There is an exception to the rules when it comes to existing clients or those who have requested information for services in the past. Regardless of whether they’ve asked for commercial messages from you or not.
There are still ethics at play with this though. So CAN-SPAM addresses this by requiring the message to have a clear label that it’s a marketing email, if the customer email was taken from existing data.
Again though, great article. PCI compliance is something I have to tell clients about at least every month if not a few times per month.