Privacy policies in the spotlight

Control of private information on social networking sites has recently come to the forefront due to members unintentionally making their personal information available to strangers, with the potential to cause embarrassment to themselves and detriment to their career.

Facebook changed its privacy policy on 26 May 2010 after its settings were criticised for being too complicated (see here). Further, the default privacy settings, for those who did not alter them, were set to allow extremely wide access to personal information by third parties. Because the privacy policy was so confusing, users could not possibly give free and unambiguous consent for third parties to access their personal information, resulting in a potential breach of data protection legislation. European privacy commissioners are increasingly calling for default settings that release the minimum necessary amount of personal information. In the light of this, any body dealing with personal information should consider the following:

• is its privacy policy sufficiently easy to understand, specifically regarding third party access to personal information; and
• should its default privacy setting continue to give broad access to a person's information unless it is specifically instructed otherwise?

A spokesman for Privacy International, a human rights watchdog, suggests that "the big battle is yet to come". All indications point towards a movement to a presumption of privacy rather than the need for users to request privacy.

Comments

[Mark Keenan]

There are still far to many "dodgy" companies out there who are essentially information farmers. We have evidence on one such company in the online divorce market who operate hundreds of websites providing services to consumers at a very low price that would seem to be impossible to make a profit on. It is not until we have spoken to competitors of theirs in other markets that we discover they are attempting to sell on their client data as PPI leads. However their privacy policies on each websites categorically state that no information will be given to third parties.

This must be going on a massive scale.