Who: Global Privacy Enforcement Network (“GPEN”)
When: September 2015
Where: Argentina, Australia, Belgium, Canada, Colombia, Estonia, France, Germany, Gibraltar, Hong Kong, Ireland, Israel, Italy, Macao, Mexico, The Netherlands, New Zealand, Norway, Republic of Macedonia, United Kingdom and The United States.
Law stated as at: 10 September 2015
What happened:
29 national regulators in 21 countries participated in a survey, or ‘Sweep’, of children’s websites and apps. The purpose of the Sweep was to see whether apps and websites are collecting personal information from children, and if indeed they are, what the information is that they are collecting, whether controls exist to limit the collection, and lastly how easily the information can be deleted. The survey was announced in May 2015 and the results have just been announced.
The Sweep uncovers unclean data protection practices
The Sweep highlighted problems in the practices of 41% of the 1,494 websites and apps considered.
Problems identified:
- The most significant and concerning discovery was the extent of personal information collected and then shared with third parties. 67% of websites and apps examined and collected personal information, 58% redirected the child off the site, and 51% indicated that they may disclose personal information to third parties.
- No notifications or warnings were provided by most sites. Only 31% of the websites and apps had protective controls to limit the collection of personal information, and a mere 24% requested some form of parental involvement.
- Certain websites collect personal data by imposing an obligation on users to create an account.
- In the UK, most common issue was a lack of information provided as to how data was going to be utilised.
The Information Commissioner’s Office (“ICO”) has said that they will write to the sites and apps that caused concern with new guidelines and with details of the changes they will be expect to make. Head of ICO intelligence hub, Adam Stephens, said the ICO ‘wouldn’t rule out enforcement action’ if deemed necessary.
Why this matters:
The results of the Sweep demonstrate the continuing commitment of privacy enforcement authorities to promote privacy on a global scale, and the alarming extent to which it is violated regarding children. GPEN hopes that the Sweep will increase public and business awareness of privacy rights and responsibilities and that it will encourage a higher level of compliance. Time will tell whether this happens.
A link to the full GPEN report can be found here.
