Information Commissioner's Office
International enforcement operation finds website privacy notices are too vague and generally inadequate
Organisations need to be more open, honest and transparent in their online privacy notices about how they handle people’s personal data, an international study has found.
A review of 30 UK websites by the Information Commissioner’s Office in the retail, banking and lending, and travel and finance price comparison sectors found that data protection and privacy notices were often inadequate. Problems identified in the operation included the following:
- While organisations were generally quite good at specifying what personal information would be collected, 26 of the 30 failed to specify how and where information would be stored. Detail about the international transfer of data was often unclear and vague.
- Twenty-six organisations failed to adequately explain whether they share data with third parties and who that data would be shared with. Three failed to address whether personal information would be disclosed to third parties at all. Only six made reference to their retention policy.
- Twenty-Four organisations failed to provide users with a clear means for deleting or removing their personal data from the website.
- Seven organisations did not make it clear how a user could access the data held about them (i.e. through a Subject Access Request).
The UK study was part of a global investigation by 24 data protection regulators from around the world – led by the ICO – which concluded that ‘there is significant room for improvement in terms of specific details contained in privacy communications’.
The privacy notices, communications and practices of 455 worldwide websites and apps in sectors including retail, finance and banking, travel, social media, gaming/gambling, education and health were assessed to consider whether it was clear from a user’s perspective exactly what information was collected, for what purpose, and how it would be processed, used and shared.
Overall, the Global Privacy Enforcement Network (GPEN) came to the following conclusions:
- Privacy communications across the various sectors tended to be vague, lacked specific detail and often contained generic clauses.
- The majority of organisations failed to inform the user what would happen to their information once it had been provided.
- Organisations were generally quite clear on what information they would collect from the user.
- Organisations generally failed to specify with whom data would be shared.
- Many organisations failed to refer to the security of the data collected and held - it was often unclear in which country data was stored or whether any safeguards were in place.
- Just over half the organisations examined made reference to how users could access the personal data held about them.
The GPEN Sweep 2017 found that some organisations still referred to outdated legislation and frameworks, while many of those providing services at international level seemed to be unclear as to which legislation or jurisdiction was applicable. It was also noted that retailers which issued e-receipts generally failed to provide any information about them on their website, while banking websites did not contain much detail in their general privacy policies.
ICO Intelligence and Research Group Manager Adam Stevens said:
“The findings suggest that people using those websites that we and our international partners examined are generally not very well informed about what happens to their data once it has been collected. That just won’t do. It is important that it is clear to people how they can control their information online.
“Working with our global partners has helped to identify that this is a worldwide problem. The GDPR is coming in May 2018 and from what we’ve found so far, organisations which want to do business or operate in the EEA have a lot of work to do if they don’t want to be breaking the new law.”
Some GPEN members will provide guidelines to data controllers in order to advise them on how to improve their practices in matters of privacy.
In the same way, some GPEN members will also contact individual data controllers in their own jurisdictions to assess what remedial action they need to take to improve user controls over their personal information.
Notes to Editors
- The Information Commissioner’s Office upholds information rights in the public interest, promoting openness by public bodies and data privacy for individuals.
- The ICO has specific responsibilities set out in the Data Protection Act 1998, the Freedom of Information Act 2000, Environmental Information Regulations 2004 and Privacy and Electronic Communications Regulations 2003.
- The ICO can take action to change the behaviour of organisations and individuals that collect, use and keep personal information. This includes criminal prosecution, non-criminal enforcement and audit. The ICO has the power to impose a monetary penalty on a data controller of up to £500,000.
- The Global Privacy Enforcement Network (GPEN) was established in 2010 upon recommendation by the Organisation for Economic Co-operation and Development. Its aim is to foster cross-border co-operation among privacy regulators in an increasingly global market in which commerce and consumer activity relies on the seamless flow of personal information across borders. Its members seek to work together to strengthen personal privacy protections in this global context. The informal network is comprised of over 60 privacy enforcement authorities in 39 jurisdictions around the world.
- The European Union’s General Data Protection Regulation (GDPR) is a new law which will apply in the UK from 25 May 2018. The Government has confirmed the UK’s decision to leave the EU will not affect the commencement of the GDPR. The Government is introducing measures related to this and wider data protection reforms in a Data Protection Bill.
- To report a concern to the ICO telephone our helpline 0303 123 1113 or go to ico.org.uk/concerns/
Latest News from
Information Commissioner's Office
New UK Information Commissioner begins term04/01/2022 13:20:00
John Edwards begins his new role as UK Information Commissioner today (Tuesday 4 January).
ICO and NHS Test and Trace agree data protection improvements following consensual audit22/12/2021 12:25:00
The ICO has issued NHS Test and Trace with recommendations to strengthen the protection of people’s personal data, so it can continue to play a vital role in tackling the pandemic.
ICO invites comments on how it uses its powers to investigate, regulate and enforce21/12/2021 12:25:00
The Information Commissioner’s Office (ICO) has launched a consultation to gather the views of stakeholders and the public on how it regulates the laws it monitors and enforces.
Cabinet Office fined £500,000 for New Year Honours data breach02/12/2021 14:38:00
The Information Commissioner’s Office (ICO) has fined the Cabinet Office £500,000 for disclosing postal addresses of the 2020 New Year Honours recipients online.
ICO issues its largest fine to tackle illegal pension cold calls02/12/2021 12:25:00
The Information Commissioner’s Office (ICO) has fined EB Associates Group Limited £140,000 for instigating over 107,000 illegal cold calls to people about pensions.
ICO issues provisional view to fine Clearview AI Inc over £17 million30/11/2021 13:05:00
The Information Commissioner’s Office (ICO) has announced its provisional intent to impose a potential fine of just over £17 million on Clearview AI Inc – a company that describes itself as the ‘World’s Largest Facial Network’.
The certainty of change: regulation in a time of political and social challenges.29/11/2021 12:25:00
Elizabeth Denham reflects on her time at the ICO, in a speech delivered to BCS, The Chartered Institute for IT (26 November 2021).
ICO calls on Google and other companies to eliminate existing privacy risks posed by adtech industry26/11/2021 12:25:00
The Information Commissioner’s Office (ICO) yesterday set out clear data protection standards that companies must meet to safeguard people’s privacy online when developing new advertising technologies (adtech).