Legal Requirements for Software Makers

Question

Since the Legal site of Stack Exchange isn't ready quite yet, I figured this would be the best place to ask this question.

What are, if any, the legal requirements (or online resources for finding this info out) that I must uphold if I wish to sell an application that acts as a Personal Account/Information Manager, which:

1. Stores (optionally, but preferably) personally identifiable information, and;

2. Stores (optionally) bank account information, such as existing and current balance, and transaction history, entered by the user.

With regards to encryption, is there a legal standard of encryption that we as developers must use for securing this type of information?

Answer 1

I am not a lawyer, but I can't imagine there's any law (in the US) which places a particular responsibility on you as an independent developer. If you worked for a financial institution there definitely would be laws and industry standards to be followed.

But as an independent developer, you still could open yourself up to potential litigation by your customers should you fail to take reasonable measures to secure their sensitive data and it gets stolen. Best bet would be to consult with knowledgeable attorney to decide what "reasonable measures" entails.

Upon further thought, you might perhaps consult with an attorney to see if Sarbanes-Oaxley might have an impact, depending on your company's structure.