14 Aug 2013, 08:50

Websites and apps that collect people’s personal information could do much better in telling people that they are doing it, why they are doing it and how securely the information will be held, says Privacy Commissioner Marie Shroff.

Ms Shroff was commenting on the results of the first Global Privacy Enforcement Network (GPEN) Internet Privacy Sweep which took place earlier this year on May 6-12. The sweep or survey of websites and apps is an example of international privacy enforcement authorities working together.

Nineteen privacy enforcement authorities from around the globe participated in the first GPEN Internet Privacy Sweep. During that time, participating authorities searched the Internet in a coordinated effort to assess privacy policies and their transparency.

Ms Shroff says the joint exercise was a pleasing one which is likely to continue into the future. “It is vital to collaborate with overseas counterparts because there are no national boundaries to many aspects of personal information.”

But she says it is disappointing that nearly one third (125) of the New Zealand websites searched (393) contained no privacy policy or any equivalent. “Each participating office selected a range of websites to scan. The first step was to see if the site showed any sort of privacy policy at all.”

“We looked at whether a new user coming to the site could read the policy and have a fair idea about whether their personal information was being collected, what it would be used for, and whether it would be shared with third parties.”

Ms Shroff says there is a lot of room for improvement with the implementation of simple things like the contact details of a privacy officer. When privacy terms and conditions are stated on many websites in New Zealand and internationally, the strong focus is on legally protecting the company, and not on providing information about consumer rights.

“The websites that collect information from people need to be less defensive and become more pro-active in shifting the emphasis on informing consumers about their information, why it is necessary to collect it and how it will be protected.”

The goals of the initiative included: increasing public and business awareness of privacy rights and responsibilities; encouraging compliance with privacy legislation; identifying concerns which may be addressed with targeted education and/or enforcement; and enhancing cooperation amongst privacy enforcement authorities.

The purpose of the sweep was not to conduct an in-depth analysis of the transparency of each website, but to replicate the consumer experience by spending a few minutes per site checking for performance against a set of common indicators.

The amalgamated international results from the GPEN internet sweep are now available. The objective is to consider further international and domestic action to encourage improved information for website users and also to make website users aware of their rights when websites solicit personal information.

Information about the Global Privacy Enforcement Network (GPEN) can be found here: https://www.privacyenforcement.net/.

ENDS

Notes for editors:

View the NZ Sweep results report

For further information contact: Annabel Fordham 021 509 735