This is a guest post by Leah Hamilton, a qualified solicitor and writer from TermsFeed.
A clear and comprehensive privacy policy is extremely important for your website or e-commerce store. This is even more true when you are using an analytics service such as Piwik PRO Cloud. Online users are increasingly interested in how their private data is dealt with, both by companies and the government. It’s best to err on the side of being open and transparent, both for legal purposes and to build customer confidence.
When using Piwik to track visitor behaviour and analyse data, Piwik recommends explaining in your Privacy Policy how Piwik works and what data it gathers.
If you don’t already have a Privacy Policy, or you need to review what it covers, this article is for you! First we’ll briefly discuss what the laws are, and then we’ll look at 3 key “dos” and 3 key “don’ts” when creating your Privacy Policy.
Privacy Laws
We’ve discussed privacy and data analytics at Piwik previously, here, where we also briefly talked about some of the laws around the world. Let’s have a quick look at some of those laws, and learn in more detail what they mean for your Privacy Policy in the next section.
First, let’s examine the US. In the US, the federal laws are sadly lacking in this department, with no general data protection law in place. Instead, state laws run the show, with the California Online Privacy Protection Act (CalOPPA) one of the most well-known laws for online data privacy.
CalOPPA requires that websites and online service operators who deal with the data of California residents must post a Privacy Policy on their website, or make the policy available through that service. For the purposes of CalOPPA, you need to cover:
what information is being collected, and any third parties this information may be shared with
how users can request changes to the information that was collected
how you will tell users if your Privacy Policy changes
the effective date of the agreement
how you will respond to user requests asking to opt-out or not be tracked
whether any other third parties can collect personally identifiable information through your service
In the EU, data protection law is more comprehensive than in most other places. The current law is called the EU Data Protection Directive (the Directive), and it applies to EU-based companies that process the data of EU citizens. A new data protection law has recently been adopted, and will be applicable as of 2018; this law is called the General Data Protection Regulation (the Regulation). The Regulation is stricter than the Directive, and includes greater penalties for non-compliance.
Although stricter, most of the general data protection requirements of the Regulation are only slightly different to the Directive. You must:
notify users that their data is being collected
tell users why their data is being collected
not keep data for longer than you have to
clearly identify yourself (the data collector)
explain how user data is kept secure
allow users to access their data
notify users if you profile them using their data, and what any consequences will be
notify users within 72 hours of any data breach occurring
Furthermore:
any requests for consent to collect must be clear and obvious
cloud service providers must also meet the requirements of the Regulation
any data transferred outside the EU is still subject to the Regulation
3 Key Things You Must Do
Follow Applicable Laws
Now that you’re aware of what the laws are, it’s important to comply with them. For a Privacy Policy that meets the strict requirements of EU law, as well as the simpler requirements of CalOPPA, you will need to cover:
your identity
what information you will collect
how you will protect it
what you will do with that information
when you will release it or share it with third parties
whether third parties can collect information through your service
how your user can see, amend, or delete the information you hold on them
how you respond to “do not track” requests
what your policy’s effective date is
any changes since then, and how you will tell users your policy has changed
dispute resolution procedures
For legal purposes, when using Piwik you will need to disclose it as a “third party” that can collect information via your website or service. As a result, you should should make it clear exactly what information Piwik collects.
Piwik collects two types of information: aggregated or non-personally-identifying information, and some personally-identifying information. Here are some of the ways in which Piwik covers its own website’s collection of these types of data. You should feel free to use these kinds of clauses in your own Privacy Policy, once you have examined how your own website or service collects data. For example, here’s how Piwik addresses non-personally-identifying information:
And here’s how Piwik covers personally-identifying information:
You can view more of Piwik’s Privacy Policy here. If you don’t already have a Privacy Policy at all, TermsFeed can help you to create one.
Get Clear Agreement to Your Privacy Policy
The next step, once you have set up a compliant Privacy Policy, is to ensure that you can get legally binding agreement to that policy. The best way to do this is to use what is called a clickwrap method. Clickwrap is a method of obtaining agreement where your users actually click “I agree” in some way. On your website, clickwrap might look like this, from Inbox.com:
In this example, you can see that the checkbox is located directly next to the statement “I have read and agree to the Terms of Use and Privacy Policy”. This is the first key feature of a legally enforceable clickwrap agreement (proximity and clarity of agreement). Second, you can see that the Terms of Use and Privacy Policy are both hyperlinked, so the user can easily open them and read them. This is enough for “reasonable notice” of those documents, and the user has been clearly informed that the checkbox and “I agree” statement relates to those documents.
Many websites use what is called browsewrap, which looks like this, from The Atlantic:
In this example you can see that the Privacy Policy is just one link among many, down the bottom of the page in the footer. It is not distinguished in any way, and there is no clear way for the user to indicate their assent.
Browsewrap is when the user is expected to browse the website and is simply assumed to agree to the Privacy Policy or legal terms. Courts looking at the issue have said that browsewrap methods are not legally enforceable, while clickwrap methods in most cases are.
Notify Users When Your Policy is Changed
Now that you have a Privacy Policy set up, and your users have clearly agreed to it, make sure that you correctly notify them when any changes are made.
The best way to notify your users is to send them an e-mail, as long as you have permission to contact them using their e-mail address, and you have collected their e-mail address legally. If this is the case, you can send an e-mail like the one from Bing below:
If you don’t have this type of permission, you should release an alert via your service, or put a notice up on your website stating that your Privacy Policy or Terms have changed. Here’s an example of what this notice might look like, from Meridian:
It is not sufficient to simply change the document and assume that users will find those changes.
3 Key Things Not To Do
Now that you’re aware of what you should be doing, let’s take a quick look at three key things that you should not do.
Don’t Prevent Users from Opting-Out of Data Collection
When using an analytics or tracking service, it may be tempting to try to stop users from opting-out. After all, if they know you’re collecting information on them, won’t most people request not to be tracked? Not necessarily. Google has indicated that around 6% of users opt out of Google Analytics tracking, and another experimenter found that this number was around 8%.
Letting users opt out will not affect your analytics in any major way, but not notifying your users that you are collecting their data, or trying to prevent them from opting-out may destroy your business credibility and make you unappealing to customers. Piwik has an example in their Privacy Policy that shows how you could allow users to opt out with a checkbox:
You could use this type of checkbox when your user creates a user account, or allow them to change this option in their account preferences. Alternatively, you could include this checkbox in a popup on your website.
Don’t Turn a Blind Eye to Who You Are Collecting Information From
It’s also important to be acutely aware of who you are collecting information from, and you shouldn’t just assume that only people in your own country are accessing your service. If you find out that users from the EU are using your service, even though you’re based in the US, you will need to ensure that you then go ahead and comply with applicable EU laws such as those we discussed earlier.
If, for example, you discover that a minor is using your service and that you have collected their personal information, you will need to comply with laws protecting children as well. In the US there is a law in place to protect the online data of children: the Children’s Online Privacy Protection Act (COPPA). COPPA requires that if you are running a service targeted at children, you must comply with its provisions. Alternatively, even if your service is not targeted at children, but you discover that a child is using your service (and that their personal information is being collected), you must comply.
Don’t Remove Links to Your Privacy Policy on your Landing Page
From a marketing perspective, many marketers advocate removing all links from landing pages, so that they don’t distract the user from the call-to-action. However, removing your Privacy Policy, especially if your landing-page is a lead generation page, could break privacy laws.
Your Privacy Policy needs to be displayed when you collect user information, ideally before you collect it. If you have a lead generation landing page with a web form for the user to provide contact information, you need to ensure that the web form itself allows the user to agree to your Privacy Policy. Here’s an example of what I mean, from Vimeo:
You can see that under the text entry fields there is a checkbox to agree to the Terms of Service. Using a similar checkbox for your Privacy Policy is an excellent way to include this important information on your landing page.
Conclusion
Creating a Privacy Policy for your website doesn’t need to be a struggle. By covering just a few key clauses and ensuring that you comply with applicable laws, you’ll be well on your way to compliance and legal safety.
Make sure that you get clear agreement to your Privacy Policy, notify users when your Policy changes, and don’t try to prevent users from opting-out of data collection if they wish. Place links to your Privacy Policy anywhere that personal information is collected from users, and do your best to know exactly who you are collecting data from.
Author’s bio:
Leah Hamilton is a qualified solicitor and writer working at TermsFeed, where businesses can create legal agreements in minutes using the Generator.
leah.hamilton@termsfeed.com
The post Writing a Privacy Policy: Dos and Don’ts appeared first on Piwik PRO - Cloud and Enterprise Analytics.