Website privacy notices "too vague and generally inadequate"

A review of 30 UK websites, by the Information Commissioner’s Office, has found that the majority of data protection and privacy notices were inadequate. The study looked at organisations across the retail, banking, lending, travel and finance price comparison sectors.

Key findings included:

  • While organisations were generally quite good at specifying what personal information would be collected, 26 of the 30 failed to specify how and where information would be stored. Detail about the international transfer of data was often unclear and vague.

  • Twenty-six organisations failed to adequately explain whether they share data with third parties and who that data would be shared with. Three failed to address whether personal information would be disclosed to third parties at all. Only six made reference to their retention policy.

  • Twenty-Four organisations failed to provide users with a clear means for deleting or removing their personal data from the website.
    Seven organisations did not make it clear how a user could access the data held about them (i.e. through a Subject Access Request).

Source: ICO

This UK study was part of a larger, global investigation, in which the ICO concluded that there is ‘significant room for improvement in terms of specific details contained in privacy communications’. Conclusions included:

  • Privacy communications across the various sectors tended to be vague, lacked specific detail and often contained generic clauses.

  • The majority of organisations failed to inform the user what would happen to their information once it had been provided.

  • Organisations were generally quite clear on what information they would collect from the user.

  • Organisations generally failed to specify with whom data would be shared.

  • Many organisations failed to refer to the security of the data collected and held - it was often unclear in which country data was stored or whether any safeguards were in place.

  • Just over half the organisations examined made reference to how users could access the personal data held about them.

Source: ICO

The GPEN Sweep 2017 highlighted a widespread use of outdated legislation and frameworks as well as a confusion as to the applicable legislation or jurisdiction.

ICO Intelligence and Research Group Manager Adam Stevens said: “The findings suggest that people using those websites that we and our international partners examined are generally not very well informed about what happens to their data once it has been collected. That just won’t do. It is important that it is clear to people how they can control their information online.

“Working with our global partners has helped to identify that this is a worldwide problem. The GDPR is coming in May 2018 and from what we’ve found so far, organisations which want to do business or operate in the EEA have a lot of work to do if they don’t want to be breaking the new law.”


For assistance with any of the points raised in this article, please contact Piers Clayden