Click to accept – not always good enough, says the New Zealand Privacy Commissioner.
Companies need to be fully transparent about their data processing practices and take steps to ensure that this is conveyed to the individuals.
In the case of a “clicked consent,” the Commissioner will also check:
- Why the company believes that click actually conveys an authority to undertake the action.
- What research was done to establish the number of people who read the terms.
- How many times do customers click the link to the terms or privacy policy before clicking the consent box?
- Do those who do click spend a long enough time on the privacy policy page to actually read it?
“If you are telling customers in the ‘click to consent’ box that their information will be used to “enhance the services we can provide you,” and page 35 of the legalese-dense privacy policy says that all your transaction information will be available to U.S. data brokers – this may be a violation of the NZ Privacy Act obligations for transparency and fairness (in particular for children and other vulnerable consumers).”
Details from the office of the New Zealand Privacy Commissioner.
[View source.]
