Websites need to improve privacy information: Privacy Commissioner
12 August 2013 – Media Release
Websites and apps that collect people’s personal information could do much better in telling people that they are doing
it, why they are doing it and how securely the information will be held, says Privacy Commissioner Marie Shroff.
Ms Shroff was commenting on the results of the first Global Privacy Enforcement Network (GPEN) Internet Privacy Sweep
which took place earlier this year on May 6-12. The sweep or survey of websites and apps is an example of international
privacy enforcement authorities working together.
Nineteen privacy enforcement authorities from around the globe participated in the first GPEN Internet Privacy Sweep.
During that time, participating authorities searched the Internet in a coordinated effort to assess privacy policies and
their transparency.
Ms Shroff says the joint exercise was a pleasing one which is likely to continue into the future. “It is vital to
collaborate with overseas counterparts because there are no national boundaries to many aspects of personal
information.”
But she says it is disappointing that nearly one third (125) of the New Zealand websites searched (393) contained no
privacy policy or any equivalent. “Each participating office selected a range of websites to scan. The first step was to
see if the site showed any sort of privacy policy at all.”
“We looked at whether a new user coming to the site could read the policy and have a fair idea about whether their
personal information was being collected, what it would be used for, and whether it would be shared with third parties.”
Ms Shroff says there is a lot of room for improvement with the implementation of simple things like the contact details
of a privacy officer. When privacy terms and conditions are stated on many websites in New Zealand and internationally,
the strong focus is on legally protecting the company, and not on providing information about consumer rights.
“The websites that collect information from people need to be less defensive and become more pro-active in shifting the
emphasis on informing consumers about their information, why it is necessary to collect it and how it will be
protected.”
The goals of the initiative included: increasing public and business awareness of privacy rights and responsibilities;
encouraging compliance with privacy legislation; identifying concerns which may be addressed with targeted education
and/or enforcement; and enhancing cooperation amongst privacy enforcement authorities.
The purpose of the sweep was not to conduct an in-depth analysis of the transparency of each website, but to replicate
the consumer experience by spending a few minutes per site checking for performance against a set of common indicators.
The amalgamated international results from the GPEN internet sweep are now available (attached). The objective is to
consider further international and domestic action to encourage improved information for website users and also to make
website users aware of their rights when websites solicit personal information.
Information about the Global Privacy Enforcement Network (GPEN) can be found here: https://www.privacyenforcement.net/.
ENDS