Privacy: commercial Web sites and online services.

Existing law requires an operator of a commercial Web site or online service that collects personally identifiable information through the Internet about individual consumers residing in California who use or visit its commercial Web site or online service to make its privacy policy available to consumers, as specified, including, among others, the requirement that the policy identifies the categories of personally identifiable information that the operator collects through the Web site or online service about individual consumers. This bill would require that policy to identify the uses and retention period for each category of personally identifiable information, and to describe the process the operator maintains allowing an individual consumer to review and request changes to any of his or her personally identifiable information. The bill would also require the operator to use reasonable security safeguards to protect personally identifiable information from unauthorized access, use, disclosure, modification, or destruction, and to describe these safeguards in its privacy policy.