A global privacy enforcement sweep joined by Jersey’s data protection regulator that examined more than 1,000 websites and mobile applications (apps) has found nearly all of them used one or more deceptive design patterns that made it difficult for users to make privacy-protective decisions.
The annual Global Privacy Enforcement Network (GPEN) Sweep took place earlier this year and involved participants or ‘sweepers,’ from 26 privacy enforcement authorities worldwide, including the Jersey Office of the Information Commissioner (JOIC). The sweep is aimed at increasing awareness of privacy rights and responsibilities, encouraging compliance with privacy legislation and enhancing cooperation between international privacy enforcement authorities. This year’s sweep was chaired by the Office of the Privacy Commissioner of Canada and saw the JOIC review the websites of local businesses ranging from construction to retail and health and beauty.
Both GPEN and the International Consumer Protection and Enforcement Network (ICPEN), who are working together to improve privacy and consumer protection for individuals around the world, published reports today outlining their findings.
Those involved in the privacy sweep replicated the user experience by engaging with websites and apps to assess the ease with which they could make privacy choices, obtain privacy information, and log out of or delete an account.
Sweepers evaluated the sites and apps based on five indicators identified by the Organisation for Economic Co-operation and Development (OECD), as being characteristic of deceptive design patterns.
For each indicator, the GPEN report found:
JOIC Operations Director Anne King said: “We support this collaboration with our international counterparts to broaden our understanding of global privacy trends and learn from the findings. When designing websites, data protection and privacy should be considered from the outset using a ‘Data Protection by Design’ approach, ensuring data protection and privacy issues are considered at the design phase of any system, service, product or process. This culture of privacy awareness should also take into account user experience, ensuring consumers are equipped to make privacy informed decisions, easily.”
The sweep was not an investigation, nor was it intended to generate formal findings regarding confirmed violations of privacy legislation. However, as in previous years, concerns identified during the sweep could not only result in follow-up work such as outreach to organisations but may also lead to the initiation of enforcement action to address identified concerns. Decisions on further specific enforcement action will be made by each GPEN member independently.
GPEN, and the JOIC, encourages organisations to design their platforms, including associated privacy communications and choices, in a manner that supports users in making informed privacy choices that reflect their preferences. Good design includes default settings that best protect privacy; an emphasis on privacy options; neutral language and design to present privacy choices in a fair and transparent manner; fewer clicks to find privacy information, log out, or delete an account; and ‘just-in-time’ contextually relevant consent options. By offering users online experiences that are free from influence, manipulation, and coercion, organisations can build user trust and make privacy a competitive advantage.
Jersey organisations can find out more about ‘Data Protection by Design and By Default’ in the resource room on the JOIC’s website.
