Tracks devices, in Pennsylvania

196 A.3d 1036 (Pa. 2018)

• Applies to an employer that stores its employees' sensitive personal information on an internet-accessible computer system.
• Exercise reasonable care to safeguard that information: the Supreme Court of Pennsylvania held, on review of an order sustaining preliminary objections in the nature of a demurrer, that such an employer has a legal duty to do so.

18 Pa.C.S. § 5771 · Read the law's page

• Do not install or use a pen register, a trap and trace device or a telecommunication identification interception device without first obtaining a court order, unless you are a provider of the wire or electronic communication service using it to operate, maintain or test the service, to protect the provider or its users from abuse, fraud or unlawful use, or with the consent of the user of the service.

73 P.S. §§ 2330.1-2330.9 (Act 86 of 2010) · Read the law's page

• If you are not an authorized user of a computer (its owner, or a person its owner or lessee has authorized to use it), do not cause software to be copied onto the computer of an authorized user in Pennsylvania, or procure its copying, and use the software to do any of the acts listed below; sections 3 and 4 apply where you act with actual knowledge, with conscious avoidance of actual knowledge or willfully.
• Do not use deceptive means to modify the page a browser opens on launch, the default provider or proxy used to access or search the Internet, or the user's list of bookmarks; deception includes an intentionally and materially false or fraudulent statement, an intentional omission or misrepresentation of material information in order to deceive the user, and an intentional and material failure to give the user any notice of the download or installation of software in order to deceive.
• Do not use deceptive means to collect personally identifiable information gathered by a keystroke-logging function that records all of a user's keystrokes and transfers them to another person, or that includes all or substantially all of the websites the user visits (other than the software provider's own) where the software was installed in a manner designed to conceal the installation from every authorized user, or by extracting from the hard drive, for a purpose wholly unrelated to any purpose of the software or service you described to the user, a credit or debit card or other financial account number, a password or PIN for a financial account, a Social Security number, or account balances or overdraft history in a form that personally identifies the user.
• Without the user's authorization and through deceptive means, do not prevent the user's reasonable efforts to block or disable software by causing software the user has properly removed or disabled to reinstall or reactivate itself; do not misrepresent, knowing it to be untrue, that software will be uninstalled or disabled by the user's action; and do not use deceptive means to remove, disable or render inoperative security, antispyware or antivirus software installed on the computer.
• Do not use the software to take control of the computer by transmitting or relaying commercial electronic mail or a computer virus that a person other than the user initiated, without the user's authorization; by using the user's modem or Internet service for the purpose of damaging the computer or making the user incur charges for a service the user did not authorize; by using the computer as part of a group of computers for the purpose of damaging another computer, including a denial of service attack; or by opening a series of stand-alone messages without the user's authorization, knowing a reasonable user cannot close them without turning off the computer or closing the Internet application.
• Do not modify a user's security or other settings that protect information about the user for the purpose of stealing personal information, or the computer's security settings for the purpose of damaging one or more computers.
• Without the user's authorization, do not prevent the user's reasonable efforts to block the installation of software or to disable it by presenting an option to decline installation when you know the installation will nevertheless proceed, by falsely representing that software has been disabled, by requiring the user in a deceptive manner to access the Internet to remove the software when you know or recklessly disregard that it frequently operates in a manner that prevents the user from accessing the Internet, by changing the software's name, location or other designation information, using randomized or deceptive file names, directory folders, formats or registry entries, or placing it in a particular directory or memory, in each case for the purpose of preventing the user from locating it, avoiding detection and removal, or evading the user's attempts to remove it, or by requiring, without the authority of the computer's owner, that the user obtain a special code or download software from a third party to uninstall it.
• Do not induce a user to install a software component by misrepresenting that installing software is necessary for security or privacy reasons or in order to open, view or play a particular type of content, and do not cause a software component to be copied onto and executed on the computer with the intent that the user use it in a way that violates section 5.
• These duties leave out the following: section 6 lifts sections 4 and 5, but not section 3, for a cable operator, computer hardware or software provider, or provider of information service or interactive computer service monitoring or interacting with a user's connection or computer for network or computer security, diagnostics, technical support, repair, authorized software or firmware updates, network management or maintenance, authorized remote system management, or detecting or preventing unauthorized use or fraud; a text or data file, an Internet website, or a website data component not executable independently of the website is not computer software; and transmission, routing, caching, a hosting medium through which a third party distributed the software, or an information location tool through which the user located it is not causing software to be copied.