tashka2000 - Fotolia

UK website privacy notices inadequate, says ICO

Privacy notices are too vague and generally inadequate, a global investigation finds, with UK websites in several sectors found wanting by an Information Commissioner’s Office review

Organisations need to be more open, honest and transparent in their online privacy notices about how they handle people’s personal data, an international study has found.

Meanwhile, a review of 30 UK websites by the Information Commissioner’s Office (ICO) in the retail, banking and lending, and travel and finance price comparison sectors found that data protection and privacy notices were often inadequate.

Although organisations were generally quite good at specifying what personal information would be collected, 26 of the 30 UK websites failed to specify how and where information would be stored. Detail about the international transfer of data was often unclear and vague.

Some 26 organisations failed to explain adequately whether they shared data with third parties and who that data would be shared with. Three failed to address whether personal information would be disclosed to third parties at all. Only six made reference to their retention policy.

A total of 24 organisations failed to provide users with a clear means for deleting or removing their personal data from the website, and seven did not make it clear how a user could access the data held about them, such as through a subject access request.

The UK review was part of a global investigation by 24 data protection regulators from around the world – led by the ICO – which concluded: “There is significant room for improvement in terms of specific details contained in privacy communications.”

The privacy notices, communications and practices of 455 worldwide websites and apps in sectors including retail, finance and banking, travel, social media, gaming/gambling, education and health were assessed to consider whether it was clear from a user’s perspective exactly what information was collected, for what purpose, and how it would be processed, used and shared.

The international investigation by the data protection regulators in the Global Privacy Enforcement Network (GPEN) concluded that privacy communications across the various sectors tended to be vague, lacked specific detail and often contained generic clauses.

Most organisations failed to inform the user what would happen to their information once it had been provided.

Organisations were generally quite clear on what information they would collect from the user, but generally failed to specify with whom data would be shared.

Many organisations also failed to refer to the security of the data collected and held, and it was often unclear in which country data was stored or whether any safeguards were in place.

Just over half the organisations examined made reference to how users could access the personal data held about them.

The GPEN Sweep 2017 report found that some organisations still referred to outdated legislation and frameworks, and many of those providing services at international level seemed to be unclear about which legislation or jurisdiction was applicable. It was also noted that retailers that issued e-receipts generally failed to provide any information about them on their website, while banking websites did not contain much detail in their general privacy policies.

ICO intelligence and research group manager Adam Stevens said the findings suggest that people using the websites examined are generally not very well informed about what happens to their data once it has been collected. “That just won’t do,” he said. “It is important that it is clear to people how they can control their information online.

GDPR is coming

“Working with our global partners has helped to identify that this is a worldwide problem. The GDPR [EU General Data Protection Regulation] compliance deadline is coming in May 2018 and from what we’ve found so far, organisations that want to do business or operate in the European Economic Area have a lot of work to do if they don’t want to be breaking the new law.”

The GDPR will apply in the UK from 25 May 2018, and the government has confirmed that the decision to leave the EU will not affect the commencement of the GDPR. The UK government is also introducing measures related to this and wider data protection reforms in a Data Protection Bill.

Some GPEN members will provide guidelines to data controllers in order to advise them on how to improve their practices in matters of privacy.

Some GPEN members will also contact individual data controllers in their own jurisdictions to assess what remedial action they need to take to improve user controls over their personal information.

GPEN was established in 2010 upon recommendation by the Organisation for Economic Co-operation and Development.

Its aim is to foster cross-border co-operation among privacy regulators in an increasingly global market in which commerce and consumer activity relies on the flow of personal information across borders. Its members seek to work together to strengthen personal privacy protections in this global context. The informal network comprises more than 60 privacy enforcement authorities, including the ICO, in 39 jurisdictions around the world.

Read more on Privacy and data protection