Utah Enacts Phishing, Pharming, Spyware Prohibitions

This posting was written by Thomas A. Long, Editor of CCH Privacy Law in Marketing.

The new Utah “E-Commerce Integrity Act,” which was signed by Governor Gary R. Herbert on March 26, 2010, prohibits certain Internet-related conduct, including phishing and pharming. The law (Senate Bill 26) also repeals Utah’s “Spyware Control Act” and enacts new restrictions on the use of spyware.

“Phishing” is defined by the law as making a communication under false pretenses purporting to be by or on behalf of a legitimate business and using that communication to induce another person to provide identification information or property.

“Pharming” is described as the creation or operation of a website that falsely represents itself to be associated with a legitimate business and that induces others to provide identifying information or property. The statute prohibits the use of spyware to collect, through intentionally deceptive means, personally identifiable information.

Civil Action, Remedies

A civil action may be brought against violators of the phishing and pharming provisions by an Internet service provider that is adversely affected by the violation; an owner of a website, computer server, or a trademark that is used without authorization in the violation; or the state attorney general. Remedies include actual damages or a civil penalty of up to $150,000 per violation.

Civil actions to enforce the law’s spyware provisions may be brought by the state attorney general, an Internet service provider, or a software company that expends resources in good faith to assist authorized users harmed by a violation, as well as a trademark owner whose mark is used to deceive authorized users.

Damages, Fees, Costs

Plaintiffs may seek actual damages and liquidated damages of at least $1,000 per violation, not to exceed $1 million for a pattern or practice of violations, and attorney’s fees and costs. Courts are authorized to award treble damages for willful and knowing violations.

Utah’s “E-Commerce Integrity Act” will take effect on July 1, 2010. Text of the law appears at CCH Privacy Law in Marketing ¶34,442.