Online Privacy Protection

December 18, 2017 by international

International Legal Research

Information about Online Privacy Protection in free legal resources:

Treaties & Agreements

Online Privacy Protection in US treaties.
Online Privacy Protection in UN treaties.
Online Privacy Protection in UN Treaty Series website.
Online Privacy Protection in OAS treaties and agreements.
Online Privacy Protection in EU treaties.
Online Privacy Protection in EU international agreements.
Online Privacy Protection in UK's treaty obligations.

International Organizations

Online Privacy Protection in documents of the UN.
Online Privacy Protection in World Bank documents.
Online Privacy Protection in UN International Law Commission (ILC) documents.

Jurisprudence $ Commentary

Online Privacy Protection in documents from the international criminal courts and the UN (PDF).
More about Online Privacy Protection in this legal plataforma.
Definitions about Online Privacy Protection in the law dictionaries.

European Union

Online Privacy Protection in EU legal acts.
Online Privacy Protection in EU consolidated texts.

IP Law

Online Privacy Protection in IP national laws.
Online Privacy Protection in IP treaties.

Online Privacy Protection

Consumers are drawn to electronic commerce not only because of the products and services available, but also because of the convenience and savings possible with online transactions.

However, there are strong indications that the growth of e-commerce is being impeded by consumers’ fears about their privacy online. Old surveys revealed that eight out of ten consumers were concerned about protecting their privacy when participating in online activities, and that 40% did not believe that online companies honoured their posted privacy policies.

Consumers’ fears about privacy are not without foundation, and are reinforced by frequent media stories about poor online practices and unauthorized access to online data.

Clearly, the need to establish and maintain the trust of customers or potential customers is a significant challenge for online businesses, and a key to lasting commercial success. Protecting privacy is an essential component of building that trust.

In addition to consumer pressures, businesses are facing an evolving legislative framework for privacy protection in the private sector. To respond to the dual incentives of developing consumer trust and compliance with legislation, companies that wish to succeed in the online world are working to make privacy protection an integral part of their business initiatives.

Online businesses need to move quickly to understand their responsibilities to respect their customers’ privacy. They need to recognize that:

if they collect, use or disclose personal information, they must do so responsibly;
they must maximize customer control over their own personal information online; and
they must ensure that their information practices are open and transparent to the consumer.

Beyond compliance with the law, privacy protection is critical to competitiveness online. Effective privacy protection is now a necessary part of doing business. There are significant risks and consequences (both commercial and legislative) to businesses that do not adequately address privacy.

Consent

Consent is to give one’s permission or to agree to something. Express consent is when it is given explicitly and unambiguously (e.g., “Yes, I agree to you selling my mailing address to third parties”). Implied consent is when it can be reasonably inferred or understood from activity or inactivity on the part of the individual (e.g., if you purchase a book online, it is reasonable that you consent to the book vendor giving your mailing address to its delivery company).

9 thoughts on “Online Privacy Protection”

international

December 18, 2017 at 4:48 am

Respect for Privacy:

Conduct business in the least privacy-intrusive manner possible.

Understand and comply with applicable privacy legislation, agreements, and standards.

Understand that personal information includes all information about, or linked to, a personally identifiable individual. This includes such information as name, address, credit card number, income, purchase preferences, and transactional data. E-mail addresses, as well as data collected from automatic tracking methods may constitute personal information if linked to an identifiable individual.

Recognize that personal information is about individuals who have the right to exercise reasonable control over that data.

Assess the impact on privacy of any proposed online practice, service, product, or technology, prior to implementation.

Take special care when dealing with children. If there is a reasonable likelihood of collecting, using or disclosing personal information from or about children, follow appropriate privacy practices
international

December 18, 2017 at 4:49 am

Openness:

Develop privacy policies and practices requiring personal information to be handled in an open and accountable manner.

Be open and informative about your organization’s policies and practices involving personal information.

Ensure your stated policies and practices are factual, accurate and complete. Do not misrepresent your company’s identity or information practices.

Inform individuals, upon request, of any records your organization maintains containing their personal information, how you use it, and what data you disclose.

Provide individuals with sufficient information for them to understand their privacy rights, and give them the opportunity to exercise those rights quickly, effectively, and without prohibitive cost. Information should include the name or title and contact information of the person/area responsible for your privacy policies and practices, as well as details about how individuals can access their personal information in your control.

Prepare and post a privacy policy on your Web site. Your policy should clearly explain all your responsibilities and information practices. Specifically, your policy should be designed so it is:
– easy to find, easy to read, easy to print, and easy to understand (e.g., use examples to explain and demonstrate your practices);
– accessible from every Web page, not just the home page; and
– written in the same language as the Web site to which it is attached.

Do not change your stated privacy policies and practices without providing enough time and information for affected individuals to make informed decisions and take appropriate action.

Inform individuals of:
– all applicable privacy legislation and agreements, and provide links to the Web sites of the authorities responsible for the administration and enforcement of these instruments;
– all professional codes of practice, seals, or other programs you must be in compliance with, and provide links to the full text of these agreements, and to the Web sites of the organizations responsible for their proper implementation and enforcement;
– the consequences to your organization for non-compliance with your privacy policies and practices, and with all other relevant programs and legislation (e.g., audit, penalties or sanctions, revocation of seal, loss of professional membership, complaint forwarded to an oversight body for investigation, or publication of name for non-compliance); and
– their recourse if they believe you are not complying with your policies and practices, or with any other relevant programs or legislation.

Explain your use of any type of Web-based tools to collect personal information that may not be readily apparent to a user. This should include use of automatic tracking software, clickstream data, cookies, and clear GIF files (i.e., Web bugs).

Explain your solicitation practices (e-mail and other means), as well as what personal information you rent, sell, or exchange to third parties for marketing or other purposes.

Inform individuals:
– if data you collect, use and disclose online is handled differently offline and why. If it is, specify how, and inform them how they can interact with your organization through other means (e.g., mail, in person, fax, or telephone); and
– of any security or privacy violations involving their personal information as soon as possible, as well as what action they can take to remedy the problem or minimize the risks.
international

December 18, 2017 at 4:49 am

Accountability:

Ensure privacy protection is a priority for all levels of your organization. Top level commitment to privacy policies and practices is critical for success.

Understand that if you collect personal information, you accept the responsibility to handle that data in accordance with your stated privacy policies and practices, and to make that information available to the individual to whom it relates.

Train your staff and make them accountable for adherence to your privacy policies and practices.

Designate a specific individual or position responsible for protecting privacy and complying with your privacy policies. While in larger organizations it may be necessary to have a team or group involved in developing and implementing your policies, with varying levels of responsibility, there always should be someone with final accountability. Provide sufficient resources and authority to discharge this responsibility in an effective and timely manner.

Publicize the identity of the responsible individual on your Web site, along with information about how they can be reached online and offline, and your days and hours of operation, if applicable.

Establish procedures for reviewing your privacy policies and practices to ensure they remain accurate, timely and complete.

Develop a process to verify your compliance with your stated privacy policies and practices, and to publicly demonstrate that compliance.

Define your obligation to undertake all necessary action to correct any problems that arise out of your non-compliance with your own policies and practices, or with any legislative requirement.

Include privacy protection requirements, comparable to your own policies and practices, in your contracts with business partners or third parties who will have access to personal information collected or controlled by you. This is particularly important if you will be sending personal information to jurisdictions without comparable privacy protection regulation. Take all reasonable steps to ensure the contracted party follows the privacy protection measures stipulated in your contracts (e.g., site visits, audits).

Understand that if you collect personal information, you accept the responsibility to handle that data in accordance with your stated privacy policies and practices, and to make that information available to the individual to whom it relates.
international

December 18, 2017 at 4:50 am

Purpose Specification.

Define the purposes or reasons why you need each piece or type of personal information (e.g.,�name, address, e-mail address, clickstream data, age, gender, income, etc.) in order to complete a specific, legitimate business transaction. When identifying potential purposes, consider the following:
– if non-identifiable information (i.e., coded, anonymous, pseudonymous, or aggregated) could fulfil the purpose;
– how the personal information needs to be collected (e.g., directly from the individual through a subscription, automatic collection of clickstream data, or from a third party) and why;
– who will need to use the information (within and outside the organization), and why; and
– to whom it will need to be disclosed, and why.

Identify any additional reasons to collect, use or disclose personal information not strictly related to the specific business transaction (e.g., incentive programs, target e-mail marketing services, data mining, etc.).

Understand that your defined purposes should be reasonable in the context of your business.

Do not define your purposes so broadly as to make them meaningless to the individual from whom you want to collect personal information.

Document your purposes so that your staff and the individuals to whom the personal information relates can know what they are.

Identify any new purpose for using previously collected personal information prior to its use.
international

December 18, 2017 at 4:50 am

Collection Limitation:

Do not collect personally identifiable information, whenever possible (e.g., permit the individual to visit your Web site without capturing clickstream data, or let the individual deal with you anonymously or pseudonymously).

Collect only the amount and type of personal information necessary and relevant for the identified purpose(s), or as required by law.

Collect personal information by lawful and fair means, and from reliable sources.

Do not collect personal information in a covert or coercive manner, or through misleading or deceptive practices.

Inform individuals, at or before the time of collection, of the type of personal information you intend to collect, including data you collect by automated means.

Inform individuals, at or before the time of collection, if the personal information to be collected is required by law and, if so, fully explain the specific requirement.

Collect personal information directly from the individual to whom it relates, except in limited and defined circumstances.

Inform individuals of the types and sources of personal information you collect indirectly for the purpose of providing services or products (e.g., data collected from third parties). Also indicate why direct collection is not possible or appropriate.

Do not allow third parties to collect personal information or cookies through your Web site unless they are contractually bound to a comparable privacy standard.

Avoid collecting unique identifiers (e.g., SIN or driver’s license number) unless their use is required by law, or express consent is obtained from the individual. If required to collect unique identifiers (e.g., for tax requirements), explain reasons to the individual at or before the time of collection.

Comply with relevant legislative restrictions on the collection of personal information (e.g., human rights legislation may limit what may be collected on employment applications).
international

December 18, 2017 at 4:51 am

Use and Disclosure Limitations.

Do not use personal information except in the manner, and for the purpose(s), identified to the individual at the time of collection, unless the individual to whom the personal information relates consents, or by authority of law.

Do not disclose, distribute, or make personal information available in any way, except for the purpose(s), and to the sources identified to the individual at the time of collection, unless the individual to whom the personal information relates consents, or by authority of law.

Take all reasonable steps to ensure that the personal information you use and disclose is relevant and necessary to fulfil the identified purpose(s), or the requirements of law.

Use both policy and technical restrictions to control unauthorized and unrelated uses and disclosures.

Limit use of persistent cookies to where they are needed for a continuing purpose. The expiry date of a cookie should be consistent with the purpose.

Inform individuals of any legal requirements you have to disclose personal information, and to whom. Include these requirements in your privacy policies.

Inform individuals of the circumstances when disclosure may take place without their prior knowledge or consent (e.g., serious and imminent threat to public health or safety). Include these reasons in your privacy policies.

Do not knowingly disclose or transfer personal information to third parties without adequate privacy safeguards.

Establish appropriate and effective controls and schedules for information retention and destruction. Ensure that all practices are fully documented.

Retain personal information in identifiable form only as long as it is relevant and necessary to fulfil the purpose(s) for which it was collected, as required by law, or as needed to give the individual to whom the information relates an opportunity to access and/or correct the data.

Destroy, erase, or permanently de-identify any personal information no longer needed for its identified purpose(s) or to meet legal requirements.

Maintain a record of disclosure so you can update third parties who have previously received personal information from you, as required (e.g., in cases when disclosed data are corrected due to inaccuracy).
international

December 18, 2017 at 4:51 am

Accuracy:

Do not knowingly collect, use or disclose inaccurate personal information.

Take all reasonable measures to ensure personal information is accurate, complete, and up-to-date, having regard for the nature of the data, the purpose(s) for which it is collected, used and disclosed, and the interests of the individual to whom the data relates.

Take all reasonable steps to minimize the chances of inaccurate data being used to make a decision about an individual. In determining what measures you should adopt, consider the extent of potential harm to the individual should you use or disclose inaccurate information.
international

December 18, 2017 at 4:51 am

Security:

Protect all personal information in your control from loss or theft, and from unauthorized access (within and outside your organization), use, alteration, copying, disclosure, and destruction.

Establish security safeguards appropriate and proportional to the sensitivity of the personal information, and the nature of the possible risks. In gauging sensitivity, consider the potential harm (e.g., financial loss, loss of benefits or opportunities, discrimination or stigmatization, public embarrassment) to the individual should the information be misused or disclosed in an unauthorized manner.

Implement effective physical, technical, and procedural measures to secure personal information on your Web site and linked computer systems.

Develop policies and practices restricting employee access (including information technology staff) to personal information for unrelated and non-business reasons. Include appropriate disciplinary measures for violation.

Inform individuals of the security measures you will undertake to protect their personal information. Include an outline of these measures in your privacy policies.

Inform individuals of the steps they should take to conduct online transactions safely and securely.

Establish appropriate access and verification procedures, audit trails and record integrity controls.

Take all reasonable steps to ensure communications or transactions through your Web site do not result in unauthorized access to individuals’ computers or personal information, or unauthorized modification or destruction of their data.

Establish secure disposal procedures to ensure personal information cannot be recreated or reconstructed after destruction, and the individual cannot be identified or linked to that data in any way.

Maintain a record of destruction documenting how and when personal information is destroyed, and the necessary authorization to do so.

Take all reasonable steps to ensure third parties involved in a transaction (e.g., those renting or leasing the data, as well as any party contracted to your organization to conduct such activities as data processing or data mining) have adequate security.
international

December 18, 2017 at 4:52 am

Complaints/Dispute Resolution:

Develop procedures to receive, investigate and respond to complaints and questions about all aspects of compliance with your posted privacy policy and practices. Permit as much secure online interaction as possible.

Ensure your complaint and dispute resolution processes are effective, fair, impartial, confidential, understandable, easy to use, and timely. They also should be cost effective for all parties involved, to the extent reasonably possible.

Respond to complaints, and take corrective action, as appropriate, in a timely manner.

Ensure your process for receiving and responding to inquiries and complaints, along with the individual’s recourse, is fully described and easily found on your Web site.

Do not charge individuals for the opportunity to exercise their right to challenge your denial of access decisions.

Inform individuals of any third party investigative and dispute resolution procedures available to them.

Direct individuals to the relevant authorities (e.g., a Privacy or Data Protection Commissioner, industry association, or seal program), if you cannot resolve the complaint to the individual’s satisfaction. Alternatively, make available third party dispute resolution mechanisms on an optional basis. Such processes should be accessible, affordable, fair and impartial for all parties.

International Legal Research

Treaties & Agreements

International Organizations

Jurisprudence $ Commentary

European Union

IP Law

Online Privacy Protection

Consent

Related Entries of the International Encyclopedia:

9 thoughts on “Online Privacy Protection”

Leave a Comment