Compliance and Regulation in Commerce

The below section will take care of some of the critical considerations when designing any commerce platform. This is not a comprehensive list though.

Data Privacy and Protection -  This is a crucial decision to keep customer data protected against all odds. There are several data protection and privacy compliance for all types of customer data, specially important in financial, healthcare, and social integration scenarios.

Cambridge Analytica’s use of data from Facebook to influence US election in 2016 was a massive issue and questioning all the social media sites about how they treat with customer personal data.

• Few important directions are Data Protection Directive 95/46/EC of 24 October 1995, General Data Protection Regulation (GDPR), United States Privacy Act, Safe Harbor Act, Health Insurance Portability and Accountability Act (HIPPA) to name a few.
• Basically for any platform to be deployed in India, Information Technology Act, 2000 is important. Recently Indian government posed a law to not share or store customer sensitive data (transaction or non-transactional) outside India. All the banks and payment gateways have strict guidelines to conform to this guidelines. Refer to “Niti Aayog” guidelines for further information.

Few of the critical data under privacy are : Email, user id, Passwords, Demographic information, Financial information such as bank account or credit card or debit card or other  instrument details, Physical, physiological and mental health condition, Sexual orientation, Medical records and history, Biometric information, Browsing history, Personal interests.

GDPR - The EU General Data Protection Regulation (GDPR) replaces the Data Protection Directive 95/46/EC and was designed to harmonize data privacy laws across Europe, to protect and empower all EU citizens data privacy and to reshape the way organizations across the region approach data privacy.  There are eight data protection principals, need a data protection officer to evaluate and audit the current state before taking any action for data privacy. The main characteristics include consent management, data archival, data cleanup, customer’s request for access or correction to their data.

It is not only applicable for applications hosted or running in EU region, even if any application running outside EU but accessed by citizens residing in EU are part of this directive.

All the major commerce platforms like SAP Hybris Commerce, IBM WCS, ElasticPath, Salesforce Commerce support framework to support GDPR.

W3C and WCAG 2.0 – This is Web Accessibility Requirement worked with World-wide consortium. Web Content Accessibility Guidelines (WCAG) 2.0 covers a wide range of recommendations for making Web content more accessible. Following these guidelines will make content accessible to a wider range of people with disabilities, including blindness and low vision, deafness and hearing loss, learning disabilities, cognitive limitations, limited movement, speech disabilities, photosensitivity and combinations of these.

There are multiple levels like A, AA, AAA to conform, depends on the type of the application and website. A set of principles and guidelines are there under WCAG to follow for the website.

ADA (Americans with Disability Act) is one of the main consideration under WCAG.

PCI -DSS - The Payment Card Industry Data Security Standard (PCI DSS) is a set of security standards designed to ensure that ALL companies that accept, process, store or transmit credit card information maintain a secure environment.

There are 12 requirements to follow here, important considerations are tokenization, two-factor authentication, 3D security.

PART 11 (Data retention and archival policy) – Important regulation for archiving data specially in US. Part 11 is the part of Title 21 of the Code of Federal Regulations that establishes the United States Food and Drug Administration (FDA) regulations on electronic records and electronic signatures (ERES). Any projects running in US should consider Part 11 specially if the application is handling content and records management.

EUROPEAN COOKIE LAW – All the websites Owned by EU or targeted for citizens in EU need to show a consent to the visitors to store and retrieve any information in the browser.

COMPLAINCE FOR CHILD AGE (COPPA) – In US, any site accessed or targeted for children under 16 years of age need to have parent or legal guardian’s consent to collect and process data. The retail sites which sells goods or merchandize for children come under this category mainly and need to comply with this compliance.