An investigation by 24 data protection regulators from around the world – led by the UK’s Information Commissioner’s Office – concluded that ‘there is significant room for improvement in terms of specific details contained in privacy communications’.The privacy notices, communications and practices of 455 websites and apps in sectors including retail, finance and banking, travel, social media, gaming/gambling, education and health were assessed to consider whether it was clear from a user’s perspective exactly what information was collected, for what purpose, and how it would be processed, used and shared.Overall, the Global Privacy Enforcement Network (GPEN) came to the following conclusions: Privacy communications across the various sectors tended to be vague, lacked specific detail and often contained generic clauses. The majority of organisations failed to inform the user what would happen to their information once it had been provided. Organisations were generally quite clear on what information they would collect from the user. Organisations generally failed to specify with whom data would be shared. Many organisations failed to refer to the security of the data collected and held – it was often unclear in which country data was stored or whether any safeguards were in place. Just over half the organisations examined made reference to how users could access the personal data held about them.
Robin Edgar
Organisational Structures | Technology and Science | Military, IT and Lifestyle consultancy | Social, Broadcast & Cross Media | Flying aircraft