GPEN

October 2017

Privacy Sweep 2017

The 2017 sweep focused on privacy policies, with results similar to the first privacy policy sweep in 2013. The participating authorities reported that website privacy notices are too vague and generally inadequate, finding most policies:
• Lack information on what happens to data after provided (i.e., purpose of use)
• Are ambiguous as to data shared with third parties (what data, with whom, etc.)
• Lack clarity on how data is secured
• Reference outdated legislation and frameworks
On the positive side, the sweep did find most organizations were generally quite clear on what information they would collect from users.

Some authorities specifically called out deficiencies relating to:
• Providing Information on automated decision-making
• Providing Information on safeguards (encryption)
• Providing Information on the location of personal data retention
• Providing Information on how to delete data
• Providing Information on the access to personal data (SARs)
https://www.privacyenforcement.net/node/906
https://www.privacyenforcement.net/sites/default/files/2017%20GPEN%20Sweep%20-%20International%20Report.pdf
jbho tl;dr. It appears that the 2017 sweep had a less focused approach than in years past (2014 – Cookies, 2015 – Mobile, 2016 – Child Data). Here’s a quick summary of some of the DPAs who participated, and what they covered:

 

September 2016

You can’t Spell Idiot Without IoT

Results of the 4th annual privacy sweep are in. Some 25 authorities participated in the 2016 IoT sweep, examining 314 different devices globally, including wellness devices, thermostats, smart TVs, connected toys, and many others. Global highlights include:
• 59% of devices failed to provide adequate privacy notice
• 48% failed to disclose third-party data sharing
• 38% provided no privacy contacts
• 68% failed to inform users how information was protected
• 72% failed to explain how users could delete their data
https://www.lda.bayern.de/media/pm2016_06_anhang.pdf
jbho: The GPEN hasn’t yet put together any comprehensive reports on any of its sweep results, but the various DPAs share nuggets here and there. The best summaries are usually put out by the Office of the Privacy Commissioner of Canada (OPC). This time, they provided a nice review, along with tips and hints, on their blog at http://blog.priv.gc.ca/index.php/2016/09/22/how-fit-is-your-gadget-putting-web-connected-healthwellness-devices-through-their-privacy-paces/

In case you forgot, GPEN is a network of approximately 50 privacy enforcement authorities from around the world, including the FTC and FCC.

Leave a Reply

Fill in your details below or click an icon to log in:

WordPress.com Logo

You are commenting using your WordPress.com account. Log Out / Change )

Twitter picture

You are commenting using your Twitter account. Log Out / Change )

Facebook photo

You are commenting using your Facebook account. Log Out / Change )

Google+ photo

You are commenting using your Google+ account. Log Out / Change )

Connecting to %s