OTTAWA – Almost 10% of Canadian websites searched as part of a global internet survey have no privacy policy, while another 10% had policies that were either hard to find or buried within legal jargon – including two Bell Media websites, Canada’s Privacy Commissioner said today.
The survey was conducted as part of a first-ever internet sweep by the Global Privacy Enforcement Network, a group of 19 privacy enforcement agencies around the world working together to support and promote privacy laws. The Privacy Commissioner of Canada coordinated the international sweep, which took place in May and surveyed more than 2,000 websites and apps.
“While we did see some good examples that demonstrated it is possible to create transparent privacy policies, unfortunately, we also found some sites with no policies, or that offered only brief, over-generalized statements about privacy,” said Jennifer Stoddart, Privacy Commissioner of Canada, in a statement.
Results from the global internet sweep highlight shortcomings in how some online organizations provide information about their privacy practices.
Stoddart cited as an example a paternity testing website with a privacy statement so skimpy it would fit into a tweet. Another website for a major fast food chain collected users’ personal information, such as photos, addresses and dates of birth, for various initiatives, yet its privacy policy was just 110 words long.
“At the other extreme, we saw long, legalistic policies that simply regurgitated – word for word in some cases – federal privacy legislation,” said Commissioner Stoddart. “Neither approach is helpful to Canadians – nor necessary, as demonstrated by the many privacy policies we saw that were able to strike a balance between transparency and concision.”
Of the more than 300 Canadian sites reviewed, the Privacy Commissioner found approximately 20% either listed no privacy contact, or made it difficult to find contact information for a privacy officer. Among the culprits were two Bell Media websites, theloop.ca and tsn.ca, which provided links to Bell Media’s privacy policy page and invites users with questions to send an email, but provides no email address (Ed note – Cartt.ca checked Bell Media’s privacy policy page for this story and found that contact information is still not listed).
More than 20% of privacy policies raised concerns with respect to the relevance of the information provided. For example, some simply quoted portions of Canada’s federal private-sector privacy law, the Personal Information Protection and Electronic Documents Act (PIPEDA) verbatim instead of explaining how personal information is actually collected and used.
Sweep participants in other countries identified similar trends and concerns. Globally, almost one quarter (23%) of the more than 2,000 websites and mobile apps examined had no privacy policy available. Meanwhile, approximately one-third of the privacy policies found raised concerns with respect to the relevance of the information in them.
“This inaugural sweep has highlighted the importance for organizations to be open and transparent about their privacy practices. People need this information to make meaningful decisions in exercising control over their own information,” said Commissioner Stoddart.
Results from the global internet sweep as well as specific examples illustrating these trends can be found in a blog post on the Office of the Privacy Commissioner’s website entitled “Initial results from our Internet Privacy Sweep: The Good, The Bad, and The Ugly.”
