Feeds

Watchdog wags finger at waffly privacy policies

Companies must cut the gobbledegook

High performance access to file storage

Privacy policies are full of jargon and are designed to reduce organisations' liability rather than to help people understand what their personal data might be used for, the UK's privacy watchdog has said.

The Information Commissioner's Office (ICO) has published guidelines on what privacy policies should look like and is engaging in a consultation on its draft code of practice.

"The ICO believes that some existing privacy notices contain too much legal jargon and are written to protect organisations, rather than to inform the public about how their information will be used," said an ICO statement about the consultation.

Privacy policies are the explanations that companies use when they gather people's personal information such as names, addresses and telephone numbers. They are often published side by side with fair collection statements. The gathering and use of this information is governed by the Data Protection Act (DPA).

The ICO has published its code of practice in order to encourage companies to be clear and fair about how they will use data, it said.

"Collecting information about people in the proper way lies at the heart of good data protection practice," said Iain Bourne, head of data protection projects at the ICO. "As more and more of our personal details are collected, we want to ensure that privacy notices provide clear, user friendly information to the public about how their personal details will be used and what the consequences of this are likely to be."

Privacy notices should be used when information will be used in an unusual way said Commissioner Richard Thomas in the consultation document.

"The duty to actively communicate a privacy notice is strongest where the intended use of the information will be unexpected, objectionable or controversial, or where the information is confidential or particularly sensitive," he said.

Thomas said that good privacy policies will "make sure individuals know how information about them will be used, and what the consequences of this are likely to be. It will also allow them to build up a picture of the sheer scale and sophistication of the systems that collect so much information about all of us."

The DPA allows the ICO to prepare codes of practice, but a breach of the code will not in itself be a breach of the law, and the ICO could not take direction action on code breaches.

The ICO said that it will take account of a company's compliance with the code's principles when a complaint has been made to it about a company's privacy practices.

The DPA demands that companies process personal information fairly. The ICO said in its guidance that this can mean either that it is processed as people would expect it to be, or that it is processed differently but a privacy notice informs them of this.

The draft code of practice contains examples of good and bad privacy notices. The consultation on the draft is open until 3 April.

See: The consultation (17-page/1MB pdf)

Copyright © 2008, OUT-LAW.com

OUT-LAW.COM is part of international law firm Pinsent Masons.

Combat fraud and increase customer satisfaction

More from The Register

next story
Putin tells Snowden: Russia conducts no US-style mass surveillance
Gov't is too broke for that, Russian prez says
Lavabit loses contempt of court appeal over protecting Snowden, customers
Judges rule complaints about government power are too little, too late
MtGox chief Karpelès refuses to come to US for g-men's grilling
Bitcoin baron says he needs another lawyer for FinCEN chat
Don't let no-hire pact suit witnesses call Steve Jobs a bullyboy, plead Apple and Google
'Irrelevant' character evidence should be excluded – lawyers
Record labels sue Pandora over vintage song royalties
Companies want payout on recordings made before 1972
EFF: Feds plan to put 52 MILLION FACES into recognition database
System would identify faces as part of biometrics collection
Edward Snowden on his Putin TV appearance: 'Why all the criticism?'
Denies Q&A cameo was meant to slam US, big-up Russia
Ex-Tony Blair adviser is new top boss at UK spy-hive GCHQ
Robert Hannigan to replace Sir Iain Lobban in the autumn
Judge halts spread of zombie Nortel patents to Texas in Google trial
Epic Rockstar patent war to be waged in California
Reprieve for Weev: Court disowns AT&T hacker's conviction
Appeals court strikes down landmark sentence
prev story

Whitepapers

SANS - Survey on application security programs
In this whitepaper learn about the state of application security programs and practices of 488 surveyed respondents, and discover how mature and effective these programs are.
Combat fraud and increase customer satisfaction
Based on their experience using HP ArcSight Enterprise Security Manager for IT security operations, Finansbank moved to HP ArcSight ESM for fraud management.
The benefits of software based PBX
Why you should break free from your proprietary PBX and how to leverage your existing server hardware.
Top three mobile application threats
Learn about three of the top mobile application security threats facing businesses today and recommendations on how to mitigate the risk.
3 Big data security analytics techniques
Applying these Big Data security analytics techniques can help you make your business safer by detecting attacks early, before significant damage is done.