Internet Sweep Reveals Deficiencies in Privacy Policies

The inaugural Global Privacy Enforcement Network Internet Privacy Sweep (the "Sweep") revealed deficiencies in how online organizations provide information related to their privacy policies and practices. The Sweep took place from May 6 to May 12, 2013 and involved 19 privacy enforcement authorities worldwide, including the Office of the Privacy Commissioner of Canada (the "Privacy Commissioner"). These authorities reviewed the privacy policies of over 2,000 websites and online applications.

Intended neither as investigation nor conclusive identification of compliance issues or legislative breaches, the Sweep’s goal was to imitate the consumer experience by spending a few minutes measuring each policy against a set of common indicators.

Key Trends Noted by the Privacy Commissioner

The Privacy Commissioner observed the following trends among Canadian organizations that were reviewed by the Sweep:

• Approximately 10% did not have a privacy policy;
   
• Approximately 10% had a privacy policy that was difficult to locate;
   
• Approximately 20% either listed no privacy contact or made it difficult to locate a privacy officer’s contact information; and
   
• More than 20% of privacy policies raised concerns regarding the relevance of the information provided. For example, rather than explain how personal information is collected and used, certain policies quoted portions of privacy legislation verbatim without accompanying explanatory notes.

Sweep participants in other countries identified similar trends and concerns.

Best Practices For Online Organizations

In light of the Sweep, online organizations should observe the following best practices:

• periodically review a website or application’s privacy policy to ensure that it meaningfully complies with applicable legislation;
   
• ensure that privacy policies are easy for users to locate and read; and
   
• prominently display the privacy officer’s contact information.

For more information on the Sweep, please see the Privacy Commissioner’s press release.