Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

Hey folks, I am providing web hosting services (shared and dedicated) and have had one of my shared hosting clients mention needing an SSL cert for their site where they are collecting insurance quotes in a form, including names and social security numbers. My privacy sense is tingling, and I'm pretty sure it's not legal (in the US) to do this on a shared system, but can't find anything to support my thoughts outside of PCI-DSS, but the customer isn't processing payments through the site so I'm not sure if that applies. I'm reading lots of policy documents where people advise to minimize and manage the PII footprint internally, but as the host I don't want to put all of my customer's clients at possible risk. I'm not looking here for legal advice necessarily, but perhaps someone in a similar position to mine can provide some rule of thumb or point me in the right direction.

share|improve this question
add comment

2 Answers

up vote 2 down vote accepted

I wouldn't even consider doing this on a shared or VPS system.
The risks are too great for information loss/leakage. As a hosting provider, I'd be seriously scared about it too, and probably offer them a cheap dedicated box instead.

share|improve this answer
    
... can't +1 this statement enough... –  danlefree Dec 29 '10 at 1:13
    
I totally agree, but I am in the position to offer a dedicated solution (which will probably blow his socks off cost wise) and he will ask why. I would prefer to have hard and fast laws to provide rather than just my suggestion for best practices. Honestly, I'm worried that they'll balk at the price and then leave and implement it on shared hosting elsewhere. As a consumer myself, I would be quite upset if people collected info irresponsibly like this, so I want laws and regulations to guide their decision, not just my .02 Big thanks for participating though I was worried i may be overreacting –  S. Cobbs Dec 29 '10 at 18:00
    
If they left it on shared hosting, and I was in your position, I'd tell them where they could stick it. I wouldn't want my company/reputation compromised by some cheapskates. –  Tom O'Connor Dec 30 '10 at 15:53
add comment

I'm assuming you are in the US since you mention PCI-DSS. You might want to take a look at HiPAA rules available here

share|improve this answer
1  
PCI-DSS isn't just a US thing. It applies world-wide, anywhere that payment card data is being processed/handled/gathered/stored. –  Tom O'Connor Dec 28 '10 at 23:37
    
Thanks for the wakeup, Tom. I hadn't particularly given the proper number of brain cells but you would clearly be right since PCI is a vendor organization, not a government's regulations. The same isn't true of HiPAA; it's the US government's regulations, which from my understanding the US is viewed as quite inferior to EU regulations on privacy, so there may be some help for S. Cobbs there. I set the company lawyers off on privacy regulations regarding EU a couple of months ago but they haven't gotten back to me on what I can and can't do with my services in the EU. –  Keith Stokes Dec 29 '10 at 0:08
    
There's other regulations too, ISO27001 compliance could play a key part in the security assurance of the host (but maybe not.. ) –  Tom O'Connor Dec 29 '10 at 7:57
    
these are great, thanks! Im not sure if HIPPA applies, as its not healthcare, BUT I think the biggest ace in my deck is that we're located in Masachusetts and we have some good data privacy laws in place (mass.gov/Eoca/docs/idtheft/201CMR1700reg.pdf). I think will approach them with this as it seems the best fit. –  S. Cobbs Dec 29 '10 at 18:05
1  
HiPAA is so much more stringent than just SSN. It's any piece of information that can be used to identify a person, such as a phone number or address. I think there are 17 or 18 defined items. S. Cobbs, you are probably on a good path with the MA laws. I remember them being mentioned as being quite stringent in a HiPAA class I took recently. Another 'gotcha' with them and other states is that if your client serves customers in that state, I believe they have to adhere to that state's privacy laws. Again, these are all suggestions. Talk to your nearest attorney. –  Keith Stokes Dec 29 '10 at 23:35
show 2 more comments

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.