EBay changes draft of privacy policy

EBay may have partially solved one issue privacy advocates had with proposed changes in its privacy policy, but another concern...

EBay may have partially solved one issue privacy advocates had with proposed changes in its privacy policy, but another concern remains.

Under the old policy, eBay would share user information only with law enforcement officials or in the case of disputes over intellectual property, according to eBay spokesman Kevin Pursglove. That has now been changed to allow the company to share user information with other users who are involved in legal action.

That change follows a separate debate about an eBay move earlier this year to post a simplified version of its privacy policy on its Web site.

Changing the policy so eBay can share user information with other users drew the ire of Jason Catlett, president of Junkbusters, who rejected the company's interpretation of its own policy.

Catlett said the policy never spells out the specific instances in which it will share user information with other users, and he called on eBay to detail specific conditions in which it will share the information.

Pursglove acknowledged that the company has been criticised for adding users to the list of people who can access information, but he said eBay is sticking with the decision. Although some privacy advocates have said the move could allow marketers to gain access to user information by pretending to be other users, Pursglove disagreed. He said the only time anyone can gain access to information is if there is a legal need.

As for the issue that first focused attention on eBay's privacy policies last February - the decision to post simplified interpretations of the policy on eBay's Web site - Catlett and fellow privacy advocate Ari Schwartz, associate director of the Centre for Democracy and Technology, disagreed on whether that was a step forward or back.

In an attempt to make its policies more user friendly in accordance with Federal Trade Commission guidelines, eBay said it would post several summaries of its privacy policy around its site, said Pursglove. According to privacy advocates, it also added a paragraph of very technical legal language saying that the summary would not be legally binding. Only the full-scale privacy policy would hold legal sway.

Privacy advocates, led by Catlett, who sent a letter to the FTC, said eBay should drop its legalistic explanations and state its privacy policy in clear and concise language, Schwartz said.

Pursglove said today that eBay ultimately agreed and changed the language to read as follows:

"It is our goal to make our privacy practices easy to understand. We have created easy-to-read summaries, privacy principles, a privacy chart and, are working on privacy enhancing technology to help summarise our full privacy policy. If you have questions about any part of this summary or if you would like more detailed information, we encourage you to review our full privacy policy."

Pursglove said that the new language would be posted on eBay's site today, with the new policy taking effect from 19 April. He added that the company never had any intention of sticking with the initial language without first hearing the opinion of privacy advocates.

"The whole idea is to solicit feedback," Pursglove said.

Schwartz said eBay's decision to drop the legalistic language from the summary of its privacy policy might set a "good precedent". Catlett would not go so far.

"I'm reluctant to enthuse," he said. "They started with a bad privacy policy and put in an outrageous clause, which they were then forced to remove. If this is progress, we are headed for a very bad future.

"This is a rare case where the policy became somewhat less bad," Catlett added.

Read more on IT risk management