A question concerning the ramifications of California's "Shine the Light" law and how it apply to associations outside of California is answered. The California "Shine the Light" law or the California Civil Code Section 1798.83, applies to a business, for-profit, or nonprofit that has an established business relationship with an individual customer -- if the business makes personal information of that customer available to third-party marketers that the association knows or has reason to know will use such information for marketing.

If the law applies, an association must provide certain information to the California resident who requests such information concerning the use of personal information.

Q: What is the California "Shine the Light" law, and how does it apply to associations outside of California?

A: The California "Shine the Light" law is the popular name for California Civil Code Section 1798.83, which became effective January 1, 2005. The statute applies to a business, for-profit, or nonprofit that has an established business relationship with an individual customer-if the business makes personal information of that customer available to third-party marketers that the association knows or has reason to know will use such information for marketing (organizations with fewer than 20 employees are exempt). A customer is an individual who is a resident of California. There is no requirement that the business have 20 employees based in California for the statute to apply.

The law applies to any nonprofit organization if the association has 20 or more employees; the association has an established business relationship with an individual (member or otherwise) who is a resident of California; and the association has within the immediately preceding calendar year provided personal information (i.e., any information that identifies or relates to a particular individual such as name, address, telephone number, etc.) to a third party that the association knows or has reason to know will use such personal information for marketing purposes.

If the law applies, an association must provide certain information to the California resident who requests such information concerning the use of personal information. The association must within 30 days of receipt of the request provide the individual with a list of the categories of personal information that were shared with particular third parties for direct-marketing purposes in the preceding calendar year. The third parties must be identified in a manner that allows the individual to determine who they are and how they can be contacted.

If the association's privacy policy either 1) discloses personal privacy information to third-party marketers only for those customers who opt-in to such disclosure or 2) does not provide such personal information for customers who opt-out of such disclosure, then the association may comply with the law by adhering to such privacy policies, disclosing such privacy policies, notifying its customers of such rights to prevent disclosure, and providing its customers a cost-free basis to do so. The privacy policy disclosure can be provided by a link on the association's home page.