Sort out your privacy notices or face action, ICO warns

Organisations must be far more open, honest and transparent in their online privacy notices or face the risk of enforcement action once GDPR comes into force, the Information Commissioner’s Office has warned.
A review of 30 UK websites by the ICO in the retail, banking and lending, and travel and finance price comparison sectors found that data protection and privacy notices were often inadequate.
While the ICO said organisations were generally quite good at specifying what personal information would be collected, 26 of the 30 failed to specify how and where information would be stored. Detail about the international transfer of data was often unclear and vague.
Twenty-six organisations failed to adequately explain whether they share data with third parties and who that data would be shared with. Three failed to address whether personal information would be disclosed to third parties at all and only six made reference to their retention policy.
Meanwhile, 24 organisations failed to provide users with a clear means for deleting or removing their personal data from the website and seven did not make it clear how a user could access the data held about them.
The UK study was part of a global investigation by 24 data protection regulators from around the world – led by the ICO – which concluded that “there is significant room for improvement in terms of specific details contained in privacy communications”.
The privacy notices, communications and practices of 455 worldwide websites and apps in sectors including retail, finance and banking, travel, social media, gaming/gambling, education and health were assessed to consider whether it was clear from a user’s perspective exactly what information was collected, for what purpose, and how it would be processed, used and shared.
ICO Intelligence and Research Group Manager Adam Stevens said: “The findings suggest that people using those websites that we and our international partners examined are generally not very well informed about what happens to their data once it has been collected. That just won’t do. It is important that it is clear to people how they can control their information online.
“Working with our global partners has helped to identify that this is a worldwide problem. The GDPR is coming in May 2018 and from what we’ve found so far, organisations which want to do business or operate in the EEA have a lot of work to do if they don’t want to be breaking the new law.”