California businesses, including those that conduct business with California residents, need to pay attention to recent lawsuits that allege the “Shine the Light” law regarding the disclosure of personal information has been violated. Big media and technology companies have been sued, wherein the plaintiffs have said their personal information has been collected, stored, and sold and these companies have intentionally kept them in the dark about their info sharing practices.
“The penalties for non-compliance with the Shine the Light law are stiff at $500 to $3,000 per violation,” said Los Angeles business litigation attorney Anthony Spotora. “We can help you conduct an audit of your company’s privacy right disclosures to ensure compliance.”
Customer information that is collected online or offline is subject to the law if the business employs more than 20 people, conducts business with California residents, and shares personal information with third parties. Businesses that fall within this scope must have a mailing address or email where customers can request privacy disclosures or have a link accessible from a company’s homepage that details this information.
“The best practice is to have a link on a business’ homepage to direct customers to their privacy rights,” said Spotora. “California customers must be given the opportunity to opt-in or opt-out and be made aware if their information has been compromised.”
The current lawsuits do not assert that personal information has been misused, but the claims do allege that companies have failed to identify a way for customers to obtain disclosures of how their information is being shared. Companies should be proactive and consult an experienced business attorney to ensure they are compliant and taking the necessary steps to protect client information and privacy rights.
The Shine the Light law, which is contained in California Civil Code § 1798.83, has been in effect since 2005 but privacy rights practices vary widely amongst companies, which is why consumers are raising concerns. Some of the current litigation also involves the state’s Unfair Competition Law that bars unfair, unlawful, and fraudulent practices by keeping information to request disclosures away or concealed from customers.
Customers have the right to receive the names of third parties and their addresses where their information was shared and what type(s) of information was provided. “Your intentions might be good as a company, but you want to be proactive and have a toll free number, address, and hyperlinks online so that customers can request this information,” said Spotora.