The privacy policy is a special document required for any website. It contains the basic provisions and rules for the receipt, storage, processing and use of any personal data of a user who visits a website. Such rules are developed based on the local policies in which the site is registered and operates. Thus, the privacy policy may differ from country to country and depend on a particular jurisdiction. The primary purpose of such a document is to inform the website visitor about what information they may have to provide during the registration and how it will be used in the future. Also, site owners must obtain consent to process the user’s data (usually, the user confirms his consent by registering on the site or filling out a particular form).
A privacy policy is needed to protect the personal information of users on the Internet. The privacy policy is regulated by law in most world countries. You’ve probably noticed that today almost every website or mobile application processes the personal data of users to increase the functionality and usability and ensure the maximum safety of visitors. This process is carried out according to the requirements specified in the protection of personal data law in each country. For example, the privacy policy has some specific features in the US, EU, and Australia.
The privacy policy in different countries has several levels of importance of information and the degree of information protection. For example, a username is not considered confidential data, but passport details, residence, and other personal details require special protection from fraudsters. The agreement on the privacy policy on the site allows you to regulate the methods of data protection and determines what information you allow to collect and how it will be used in the future. In addition, it also determines whether a website can transfer your information to any third party. Any site owner is personally responsible for ensuring the confidentiality of the personal information received from users, and all data must be preserved and protected from third parties.
Personal information and privacy policy
Basically, it is accepted that the information that directly or indirectly identifies a person’s personality is called personal. In relation to such information, various laws on the protection of personal data have been created. For violation of many of them, you can even get a prison sentence, so you should carefully and thoughtfully take the protection of personal information.
Personal information usually includes a person’s passport data, as well as his email data, place of residence, date of birth, phone number and other data.
Internet site privacy policy is typically based on some peculiarities of the legislation that operates in the particular jurisdiction where the website is registered. A website owner must meet specific requirements to ensure the safety of information: for instance, data that the site visitors left for authentication or other purposes.
EU privacy policy
In the countries of the European Union, control over the safety and security of the personal data of users is carried out using the GDPR. Before registering a site, any company must necessarily take into account the need to develop a site’s privacy policy. Otherwise, you can get a hefty fine for violating the law.
The most recent document regulating these rules was developed in 2018. The paper unites the processes of collecting individual data of all users of websites in the EU. Instead of GDPR, the European Union was previously covered by the Data Retention Directive.
The owners of any site must also additionally comply with some requirements of the Economic Development Organization:
- promptly notify the user of the purpose for which the data is collected;
- notify each user of the site that their data is subject to collection and processing;
- to ensure the confidentiality of the received user data if the site visitor is not aware of this or against it.
UK Data Security Policy
Today, a large number of sites operating in the UK are used not only by residents of England but also by many other countries. However, the privacy policy is somewhat different from what was previously described for sites in the European Union. Let’s consider this information in more detail.
In the UK, the protection of user data on the Internet is ensured by a law passed by the Parliamentary Government of that country. The following provisions are spelt out in the law:
- The processing of the personal information of users must be carried out legally and honestly.
- The site owners have the right to collect only the required minimum of information, therefore exceeding the collection of user data is excluded.
- All purposes of collecting personal information from users of the sites are clearly formulated and regulated by law.
- The period of using personal data of users is limited; therefore, after the expiration of the period of use, all data is deleted.
- The information that the site owners receive must be up-to-date at the time of collection.
- During the processing of personal data, the user’s rights must always be taken into account.
- Users’ personal data must be subject to strict anti-illegal activities.
- The data received from users can only be used in the territory of the European Economic Area.
US privacy policy
At the moment, there is no special law in the United States of America that regulates the privacy policy of users’ personal data on the Internet. There are several pieces of legislation that serve these purposes:
- COPPA is a separate child protection law, the main requirement of which is to comply with the privacy policy for minors. In different states, this age may be different – it ranges from 18-21 years.
- GLBA is the Gramm-Leach-Bliley Act, which requires companies in the financial segment to provide information exchange data in text format.
- HIPAA is the health insurance law. It obliges all medical institutions in the country to provide timely reports on the storage of patients’ personal data.
Some US states also use their own local laws in addition, developed separately for each state. For example, the state of California has a rule that the privacy policy of sites that collect data about its residents must be publicly published.
If you are registering a company in the United States, there are some privacy policy requirements you should consider:
- clearly define what personal data will be collected;
- how the security of the requested data will be ensured;
- for what purpose the received information will be used;
- whether it is planned to transfer the information, received to third parties – and if so, for what purpose, and how it will be used;
- what rights are granted to the user who provided their confidential information.
The procedure for developing a privacy policy
As we said earlier, the privacy policy may be different in the territory of each country. It is developed individually and is valid only in a specific region where the site is registered. The Privacy Policy most often includes a request to receive data, store information and process it. Therefore, at the stage of preparing a set of security policy rules, it is necessary to determine what information will be requested from users and for what purpose.
The less data is required from a user, the simpler the policy is. For example, if the customer personal data is collected by a company to compile a list of users for a subsequent advertising mailing campaign, then only an email address is required from customers. In other cases, they may also ask for the date of birth and place of residence, phone number, place of work, information about relatives and additional personal information.
Typically, the privacy policy includes the following points:
Official information about the activities and purposes of the company owning a site that a user is visiting
- Data collection process.
- Use of the received data.
- Transfer of the collected data to third parties, if provided for by the site’s privacy policy.
- Ensuring the protection of the personal data of users.
- Respect for user rights stipulated by company policy.
- Cookie Policy.
- Security policy update.
- Company contact information.
Cookies
Today, almost any site asks the user to “accept cookie data”. Some Internet users may be confused by this proposal because they do not quite understand what it means and why a site needs their data. In short, each web page stores tiny .txt files on the client’s computer. These files usually contain information about how the customer used the company’s web page. Do not be afraid of this because cookies do not allow you to identify a client, so your personal data will not be available to anyone. Each user can independently disable the use of cookies in the settings of their Internet browser if they do not want information about the use of the site to be collected from them.
Also, many web pages sometimes use gadgets to collect statistics that show a user’s browsing habits. This includes the following data: which sections of the site a user most often visits, how quickly they view the information reflected on a website page, which order they prefer to open the tabs, as well as the time of using a particular page and the algorithm of actions on the site.
The collection of this data allows the site to improve its interface to make it more user-friendly when browsing. Such programs are part of a web page, and information that is collected in the process may be transferred to third parties.
Software gadgets are also used to broadcast certain advertisements to users. Instead of displaying random goods and services, such ads create a personalized experience and show the products that will most likely interest particular clients. Advertising companies sometimes use this information to promote their products, provided that this process is carried out in accordance with the law adopted in the territory of a particular country.
Conclusion
Thus, the site’s privacy policy is needed not only in order to legally collect personal information about users but also to make their stay on the site as convenient as possible for them. Besides, privacy policy works in a way that it allows offering a client a particular product that will potentially interest them: it filters out unnecessary advertising on the Internet.
