When it comes to competing against Amazon, eBay or even Japan's Rakuten, one of the more challenging aspects is their third-party marketplaces, which give each a seemingly endless inventory at minimal risk. But the odds may be getting more even, as shoppers are starting to notice that some manufacturers are strictly enforcing their authorized reseller rules.
The immediate impact on shoppers is they may find that the expensive flat-screen TV, surround-sound speakers or refrigerator that looked like such a bargain on Amazon voids the warranty. The arguably-unrealistic expectation from consumer goods manufacturers—which sharply strengthens the hands of traditional e-tailers trying to fight against these third-party marketplaces—is that shoppers would not only notice the actual name of the merchant shipping the item, but would take the time to run that name on the manufacturer's site to see if they are truly an authorized reseller. Or they could just make the purchase from Target.com or Bestbuy.com and know for certain.
A Home Depot manager left a laptop–with personal data on about 10,000 employees–in his car and it was stolen, Home Depot confirmed on Wednesday, according to this Associated Press story.
The laptop contained names, home addresses and Social Security numbers of certain Home Depot employees, most in the Northeast, but no customer data, the story said. …
As the legal arguments start to unfold—as they did this week in a Boston federal courtroom—there is little discussion yet about responsibility to protect cardholder data. Most of the TJX defenses seem to be variants of "Everybody was doing it, so why pick on me?" As the state trooper would reply on that New York highway, "Because you got caught." Read more...
Every day, we’re seeing a steady flow of hints that alternative payments are becoming a wee bit less …. well …. alternative.
This week, US Airways announced that it would start accepting PayPal for tickets. That news follows similar announcements from Northwest Airlines, Southwest Airlines and Midwest Air. Nothing shocking here, but airlines are hardly cutting-edge payment outfits. If they’re warming up to alternative payments, there may be something there.…
To be certain, MasterCard, AmericanExpress and others have been active in PCI circles, but they're been quite willing to let Visa take all of the public heartaches.
Is that now changing, albeit a little bit? When the National Retail Federation came out, asking that retailers no longer be required to retain credit card data after authorization, it was MasterCard—not Visa—that issued a statement and a stinging statement it was, saying the NRF plan was "inaccurate and unjustified."Read more...
Pathmark is rolling out a branded combination loyalty and payment card, selling convenience and discounts to its customers. The catch: the combo card only offers debit payment. Read more...
TJX knew how "antiquated and deficient" its security efforts were and yet never told MasterCard or Visa, resulting in negligent misrepresentations. That's how U.S. District Court Judge William Young summed up what the banks are going to have to prove to win at trial in his courtroom. In an hour-long federal court hearing Tuesday in Boston, Young peppered attorneys from TJX, TJX processor Fifth Third Bank and banks suing TJX, providing a good sense of where a TJX bank trial might go. Read more...
When Gov. Arnold Schwarzenegger this weekend vetoed California's data breach bill, it was much more important than a single state's governor veto. Much more important. Read more...
The court's decision was being closely watched in E-Commerce circles because it spoke to how far federal law will go to protect online businesses from new and potentially threatening technologies. In this instance, though, the judge didn't address the E-Commerce issues in those broad terms, finding more than enough specifics in this case to justify the preliminary injunction, she said. Read more...
The proposed California law would have required retailers to protect data in a manner more demanding than current Payment Card Industry Data Security Standard (PCI DSS) requires. The current version of the bill, Schwarzenegger said, "attempts to legislate in an area where the marketplace has already assigned responsibilities and liabilities that provide for the protection of consumers." Read more...
To the Members of the California State Assembly: I am returning Assembly Bill 779 without my signature.
Protecting the personal information of every Californian is very important to me and I am committed to strong laws that safeguard every individual’s privacy and prevent identity theft. Clearly, the need to protect personal information is increasingly critical as routine commercial transactions are more and more exclusively accomplished through electronic means.
However, this bill attempts to legislate in an area where the marketplace has already assigned responsibilities and liabilities that provide for the protection of consumers. In addition, the Payment Card Industry has already established minimum data security standards when storing, processing, or transmitting credit or debit cardholder information.
This industry has the contractual ability to mandate the use of these standards, and is in a superior position to ensure that these standards keep up with changes in technology and the marketplace. This measure creates the potential for California law to be in conflict with private sector data security standards.
While I support many of the provisions of this bill, it fails to provide clear definition of which business or agency "owns" or "licenses" data, and when that business or agency relinquishes legal responsibility as the owner or licensee. This issue and the data security requirements found in this bill will drive up the costs of compliance, particularly for small businesses.
I encourage the author and the industry to work together on a more balanced legislative approach that addresses the concerns outlined above.
Sincerely,<br>
Arnold Schwarzenegger …
BILL NUMBER: AB 779 ENROLLED
BILL TEXT
PASSED THE SENATE SEPTEMBER 6, 2007
PASSED THE ASSEMBLY SEPTEMBER 10, 2007
AMENDED IN SENATE AUGUST 31, 2007
AMENDED IN SENATE AUGUST 20, 2007
AMENDED IN SENATE JULY 10, 2007
AMENDED IN SENATE JULY 3, 2007
AMENDED IN ASSEMBLY JUNE 1, 2007
AMENDED IN ASSEMBLY MAY 14, 2007
AMENDED IN ASSEMBLY MAY 1, 2007
AMENDED IN ASSEMBLY APRIL 10, 2007
INTRODUCED BY Assembly Member Jones
(Coauthors: Assembly Members DeSaulnier, Huffman, and Krekorian)
(Coauthor: Senator Migden)
FEBRUARY 22, 2007
An act to add Sections 1724.4 and 1724.5 to, and to repeal and
amend Sections 1798.29 and 1798.82 of, the Civil Code, relating to
personal information.
LEGISLATIVE COUNSEL’S DIGEST
AB 779, Jones. Personal information: state agencies and
businesses.
(1) Existing law imposes specified duties upon certain persons or
businesses that conduct business in California to, among other
things, take reasonable steps to destroy customer records, implement
and maintain reasonable security measures, disclose a breach of
computerized data, and, upon request, provide specified information
to a customer in relation to the disclosure of personal information
to 3rd parties. For a violation of any of the above-described
provisions, existing law allows an injured customer to institute a
civil action to recover damages or for injunctive relief.
This bill, on and after July 1, 2008, would prohibit a person,
business, or agency, as defined, that sells goods or services to any
resident of California and accepts as payment a credit card, debit
card, or other payment device, from storing, retaining, sending, or
failing to limit access to payment-related data, as defined,
retaining a primary account number, or storing sensitive
authentication data subsequent to an authorization, as specified,
unless a specified exception applies. Upon a violation, and as
applicable, the bill would apply specified reimbursement and notice
provisions, as …
Singing an off-key version of “Anything You Can Do, I Can Do Better” in the general direction of SAP, Oracle has made a $6.66 billion bid for BEA Systems. The move comes on the heel’s of SAP’s announcement this week that it is paying $6.8 billion to buy Business Objects. (So it’s a couple of hundred million shy of SAP’s deal. Who said Oracle’s always careful about being accurate in its song choices.)
BEA has been under pressure from investor Carl Icahn to consider a sale of the company, according to this Wall Street Journal story.…
Waiting for EBay’s long-awaited AdContext program? Pull up a chair, as you may have a very long wait. Indeed, this is one of the lenghtiest public betas I’ve ever seen. In the early summer of 2006, EBay announced that its program to scan news stories for references to products that they have on auction, to be called AdContext.
It was supposed to ship by the end of the year. In November, that “end of year” became “January.” In December, “January” became “first quarter 2007.” In March, no timing was mentioned at all.
On Thursday, an EBay senior manager said the product was still in beta and he couldn’t even guess at a new target for launch. Guess this kind of functionality is more difficult than it seemed. At least more difficult for EBay.…
When TJX attorneys this week argued how much this settlement was going to cost them–including a one-day 15 percent-off sale for all consumers–they defended their points with plenty of numbers, so the judge could see this wasn’t made up.
But a crafty analyst at Javelin Strategy took out her own calculator and had some fun pointing out the misleading nature of the attorney’s selected financial factoids. (Note: If you hate math, you’re advised to skip the link.)…
On Monday, U.S. District Court Judge Audrey B. Collins will likely charter new E-Commerce ground on Monday from her Los Angeles courtroom, when she rules on a preliminary injunction request from Ticketmaster against a 10-person Pittsburgh ISV called RMG Technologies. The Ticketmaster case is interesting because of its non-traditional legal issues—where Ticketmaster's core argument is that it's being damaged by a potential loss of consumer goodwill—plus the fact that these are claims that couldn't happen outside of current-day E-Commerce. Read more...
"Shoppers want barcode readers on their trolleys (shopping carts) to calculate the nutritional content and tell them when they have blown their calorific budget," EDS's Sion Roberts, director of consumer industries and retail, told Reuters. Setting aside for the moment whether consumers really want to know, the bigger question is whether retailers and consumer goods manufacturers would want to pay to let them know. Read more...
Barnes & Noble is gently testing the mobile-commerce waters, as it prepares to announce a deal on Monday to sell books, CDs and DVDs, but only on BlackBerry phones.
The deal with Digby will deliver a small version of the book chain’s site—optimized for mobile, presumably—to allow faster and easier ordering. Downside: the BlackBerry version will only be updated once a day.…
But since the breach--where the credit card data of some 46 million consumers fell into unauthorized hands—the company seemed to have made PR blunder after blunder. And yet, their financial health could hardly be better. Revenue and every key metric has improved since the breach's announcement and the negotiated settlement with consumers suing TJX is likely to be approved and it's extremely favorable to TJX. Read more...
‘Tis the season to be discreet. Fa La La La….
When retailers start pushing holiday sales before Thanksgiving, consumers get annoyed. If they knew retailers were starting holiday sales weeks before Halloween, they’d go ballistic. And yet, that’s precisely what The New York Times says many major chains are doing: Celebrating The Euphenisms.
“Shattering records for an early start, Wal-Mart is cutting prices on toys in mid-October, but the company is not calling it a holiday sale. L. L. Bean has started advertising free shipping — but it is shying away from the H word. And Toys “R” Us is marketing a temporary store in Manhattan, but consumers have to study ads to find the name: Holiday Express,” the story said. Well worth a read.…
After hearing about a revised proposed consumer settlement that supplements $30 in-store vouchers with $15 checks—along with other changes, such as increasing the voucher cap from $7 million to $10 million—Young said he was inclined to approve the deal but wanted to consider the options just a bit longer. Much of the Wednesday hearing before the judge in the Boston federal courthouse focused on whether TJX could contact most of the consumer victims by mail, instead of the TJX preferred approach of advertisements and selected mailings. Read more...
SAP has agreed to acquire Business Objects in a $6.6 billion cash deal. This deal, the biggest ever for SAP, is clearly aimed at countering quite a few acquisitions from rival Oracle.
The companies said the deal—which Business Objects will recommend to its shareholders, subject to regulatory conditions—is expected to close in the first quarter of 2008, according to this Reuters story.
Reuters quoted Trip Chowdhry, a Silicon Valley based analyst with Global Equities Research, as saying the SAP deal was backward-looking. “I don’t think this is something investors should be cheering,” he said. “They are picking up the leftovers. The good companies at the right prices have already been acquired.”…
Retailers started using the credit card numbers to identify purchases with specific consumers, given that they had to store them anyway. It turned out to be a convenient link into CRM systems, especially for customers who weren't using the traditional retailer-issued loyalty card. Read more...
Retailing's most powerful lobby—the National Retail Federation (NRF)—is launching a campaign to change the way that credit cards and retailers interact. Conceding that the Payment Card Industry (PCI) procedures have simply not been effective at stopping massive retail breaches, NRF CIO David Hogan has been pushing for a radical change in tactics, one that will require Visa, MasterCard and AmericanExpress to change procedures.
"It is unlikely PCI will ever be able to keep pace with the continually-evolving sophistication of the professional hacker, or anticipate every possible variation of future attacks," Hogan said in a letter to Bob Russo, the head of the PCI Security Council. "We believe the time has come to rethink the assumptions behind PCI."
Read more...
Cards issued by European banks when used online cross border don't usually support AVS checks. So, when a European card is used with a billing address that's in the US, an ecom merchant wouldn't necessarily know that the shipping zip code doesn't match the billing code.
-Marc
