GPEN Sweep 2017 - International enforcement operation finds website privacy notices are too vague and generally inadequate
The following press release has been created by the UK Information Commissioner's Office as 2017 Sweep lead. Links to press releases issued by participants can be found at the bottom of this page.
Organisations need to be more open, honest and transparent in their online privacy notices about how they handle people’s personal data, an international study has found.
An investigation by 24 data protection regulators from around the world – led by the UK’s Information Commissioner’s Office – concluded that ‘there is significant room for improvement in terms of specific details contained in privacy communications’.
The privacy notices, communications and practices of 455 websites and apps in sectors including retail, finance and banking, travel, social media, gaming/gambling, education and health were assessed to consider whether it was clear from a user’s perspective exactly what information was collected, for what purpose, and how it would be processed, used and shared.
Overall, the Global Privacy Enforcement Network (GPEN) came to the following conclusions:
- Privacy communications across the various sectors tended to be vague, lacked specific detail and often contained generic clauses.
- The majority of organisations failed to inform the user what would happen to their information once it had been provided.
- Organisations were generally quite clear on what information they would collect from the user.
- Organisations generally failed to specify with whom data would be shared.
- Many organisations failed to refer to the security of the data collected and held - it was often unclear in which country data was stored or whether any safeguards were in place.
- Just over half the organisations examined made reference to how users could access the personal data held about them.
The 2017 GPEN Sweep found that some organisations still referred to outdated legislation and frameworks, while many of those providing services at international level seemed to be unclear as to which legislation or jurisdiction was applicable. It was also noted that the retailers who issue e-receipts generally failed to provide any information about them on their website, while banking websites did not contain much detail in their general privacy policies.
ICO Intelligence and Research Group Manager Adam Stevens said: “The findings suggest that people using those websites that we and our international partners examined are generally not very well informed about what happens to their data once it has been collected. That just won’t do. It is important that it is clear to people how they can control their information online.
“Working with our global partners has helped to identify that this is a worldwide problem. The GDPR is coming in May 2018 and from what we’ve found so far, organisations which want to do business or operate in the EEA have a lot of work to do if they don’t want to be breaking the new law.”
Some GPEN members will provide guidelines to data controllers in order to advise them on how to improve their practices in matter of privacy.
In the same way, some GPEN members will also contact data controllers in their own jurisdictions to assess what remedial action they need to take to improve user controls over their personal information.
ENDS
The international report can be accessed here: GPEN Sweep 2017 International Report
Participant media releases:
Albania
http://www.idp.al/2017/10/25/gpen-privacy-sweep-2017-finds-ambiguity-in-privacy-policies/?lang=en (English)
Canada
https://www.priv.gc.ca/fr/nouvelles-du-commissariat/nouvelles-et-annonces/2017/nr-c_171024/ (Français)
https://www.priv.gc.ca/en/opc-news/news-and-announcements/2017/nr-c_171024/ (English)
Canada (Ontario)
Canada (British Columbia)
https://www.oipc.bc.ca/news-releases/2090
Gibraltar
Ireland
Mexico
http://inicio.inai.org.mx/Comunicados/Comunicado%20INAI-350-17.pdf (Español)
Morocco
New Zealand
United Kingdom