SoylentNews is people
SoylentNews
from the don't-make-them-100-pages-long dept.
The key to turning privacy notices into something useful for consumers is to rethink their purpose. A company's policy might show compliance with the regulations the firm is bound to follow, but remains impenetrable to a regular reader.
The starting point for developing consumer-friendly privacy notices is to make them relevant to the user's activity, understandable and actionable. As part of the Usable Privacy Policy Project, my colleagues and I developed a way to make privacy notices more effective.
The first principle is to break up the documents into smaller chunks and deliver them at times that are appropriate for users. Right now, a single multi-page policy might have many sections and paragraphs, each relevant to different services and activities. Yet people who are just casually browsing a website need only a little bit of information about how the site handles their IP addresses, if what they look at is shared with advertisers and if they can opt out of interest-based ads. Those people doesn't[sic] need to know about many other things listed in all-encompassing policies, like the rules associated with subscribing to the site's email newsletter, nor how the site handles personal or financial information belonging to people who make purchases or donations on the site.
When a person does decide to sign up for email updates or pay for a service through the site, then an additional short privacy notice could tell her the additional information she needs to know. These shorter documents should also offer users meaningful choices about what they want a company to do – or not do – with their data. For instance, a new subscriber might be allowed to choose whether the company can share his email address or other contact information with outside marketing companies by clicking a check box.
This article was originally published on The Conversation. Read the original article.
(Score: 2) by NotSanguine on Wednesday October 11 2017, @07:17PM (3 children)
Here's the (sanitized) privacy policy I (IANAL) wrote for a website I created. I think it balances the privacy of users with shielding the website owner(s) from liability:
The above would need to be modified to support different business models, but the basics should be retained:
1. Website will *not* share data with *anyone* without authorization;
2. Website will *not* store personal information on the site;
3. Website will make every effort to secure personal information;
4. Website will not be liable for the release of personal information by others.
No, no, you're not thinking; you're just being logical. --Niels Bohr
(Score: 0) by Anonymous Coward on Thursday October 12 2017, @12:55AM (2 children)
Your policy is worthless to the users. Terms can be changed at any time without notice. "specifically authorized" isn't defined nor limited so management can authorize anything regardless of what the rest of the policy says. Who stores data mining data on web servers? You transfer that data onto other servers, your policy doesn't prevent that. You try to disclaim any liability for your own screw ups, so even if you had a good policy you just told everyone you don't have to follow it. Etc... Your policy sucks. Get one reviewed by a lawyer next time.
(Score: 2) by NotSanguine on Thursday October 12 2017, @01:02AM (1 child)
Thank you for your input.
Go ahead and try to sue me. See how well that works, friend.
No, no, you're not thinking; you're just being logical. --Niels Bohr
(Score: 0) by Anonymous Coward on Thursday October 26 2017, @11:57PM
Exactly, you claimed it balances rights for the user and it doesn't.