October 2017
Privacy Sweep 2017
The 2017 sweep focused on privacy policies, with results similar to the first privacy policy sweep in 2013. The participating authorities reported that website privacy notices are too vague and generally inadequate, finding most policies:
• Lack information on what happens to data after provided (i.e., purpose of use)
• Are ambiguous as to data shared with third parties (what data, with whom, etc.)
• Lack clarity on how data is secured
• Reference outdated legislation and frameworks
On the positive side, the sweep did find most organizations were generally quite clear on what information they would collect from users.
Some authorities specifically called out deficiencies relating to:
• Providing Information on automated decision-making
• Providing Information on safeguards (encryption)
• Providing Information on the location of personal data retention
• Providing Information on how to delete data
• Providing Information on the access to personal data (SARs)
https://www.privacyenforcement.net/node/906
https://www.privacyenforcement.net/sites/default/files/2017%20GPEN%20Sweep%20-%20International%20Report.pdf
jbho tl;dr. It appears that the 2017 sweep had a less focused approach than in years past (2014 – Cookies, 2015 – Mobile, 2016 – Child Data). Here’s a quick summary of some of the DPAs who participated, and what they covered:
- Albania (financial, banking, retail, social media, education, health, and travel agencies)
- Canada (educational apps)
- Alberta (public, private and health sectors)
- Ontario (online educational services)
- Gibraltar (retail, finance, banking, travel, social media, gaming/gambling, education, and health)
- Ireland (retail, finance, banking, travel, social media, gaming/gambling, education, and health)
- Mexico (financial sector, travel agencies, social media, education, and health)
- Morocco (education, health, e-tailers, travel, gaming/gambling, social media, finance, and banking)
- New Zealand (retail, finance, banking, travel, social media, gaming/gambling, education, and health)
- United Kingdom (retail, banking, lending, travel, and finance price comparison sectors)
September 2016
You can’t Spell Idiot Without IoT
Results of the 4th annual privacy sweep are in. Some 25 authorities participated in the 2016 IoT sweep, examining 314 different devices globally, including wellness devices, thermostats, smart TVs, connected toys, and many others. Global highlights include:
• 59% of devices failed to provide adequate privacy notice
• 48% failed to disclose third-party data sharing
• 38% provided no privacy contacts
• 68% failed to inform users how information was protected
• 72% failed to explain how users could delete their data
https://www.lda.bayern.de/media/pm2016_06_anhang.pdf
jbho: The GPEN hasn’t yet put together any comprehensive reports on any of its sweep results, but the various DPAs share nuggets here and there. The best summaries are usually put out by the Office of the Privacy Commissioner of Canada (OPC). This time, they provided a nice review, along with tips and hints, on their blog at http://blog.priv.gc.ca/index.php/2016/09/22/how-fit-is-your-gadget-putting-web-connected-healthwellness-devices-through-their-privacy-paces/
In case you forgot, GPEN is a network of approximately 50 privacy enforcement authorities from around the world, including the FTC and FCC.