Running multiple blogs since 2013 and shifting to learning about websites, I have discovered that there is more to putting your website online than you think. If you have a website, it is legally required to have and disclose a standard privacy policy on that website. This is because data has become a commodity that’s worth a lot of money to marketers, advertisers, and businesses. As far as the law is concerned, if you’re going to collect, use and possibly sell personally identifying information (PII), then, the people you’re collecting it from have a right to know.
Depending on the country and location of your website and that of your visitors, there are several laws protecting consumer data (such as the Computer Fraud & Abuse Act). These laws require a standard privacy policy if your website collects any personally identifying information (PII) about website visitors.
Although it can be tempting to simply pull a standard privacy policy off the web, you need to give your policy’s wording careful thought before you post it. In this article, I’ve listed the top five considerations to focus on when drafting your company’s standard privacy policy.
1. What Personal Information do you Collect?
Your standard privacy policy needs to clearly state what type of personal information you collect from your website's visitors. In this case, personal information generally includes any data that could be used to identify an individual or website visitor. They include:
- Social security number
- Credit card number
- House, Office or Mailing address
- Billing address
- First and last name
- Phone and Telephone number
- Email address
2. How is this Personal Information Stored
After your site collects any of these pieces of information, is it kept on a secure server? Is it maintained in a credit card processing system? You need to inform consumers of that process so they can decide for themselves whether the information they’ve provided to you is secure enough for them—or whether they want to supply it at all.
3. Will you share these Personal Information? If yes, How?
A comprehensive and standard privacy policy must also include information about how the personal information of your website visitors will be used. Personal information can be used for:
- Communicating with customers, follow up on their orders or requests.
- Sending brand, company or personal announcements or advertisements. This could be in form of email blasts or Facebook ads.
- Sales of products, goods and services to third parties
How to use the PII you collect is up to you (within legal limits, of course). No matter what you decide, however, you must inform your website visitors of your plans.
4. How would you handle the Personal Information of Minors?
Generally speaking, the law tends to be highly protective of minors, and regulations on collecting PII from this population are no exception. Although laws vary from state to state and country to country, they typically require that minors be given the opportunity to request removal of their PII from your database.
5. Does it Comply with Policies Such as GDPR and CalOPPA?
One of the biggest reasons to seek an attorney when preparing a standard privacy policy is the myriad of international, state, federal, and local laws and regulations that impact the language you need to use.
For example, if your business is operating in California, you’ll need to comply with the California Online Privacy Protection Act (CalOPPA). In addition to the aforementioned opt-out protection for minors, CalOPPA requires that websites collecting PII provide a conspicuous link to the site’s standard privacy policy. It also delineates specific clauses that must be included within that policy.
Depending on the reach of your business, your standard privacy policy may also need to comply with the General Data Protection Regulation (GDPR), which provides standards for handling and protecting data throughout the European Union. Note that GDPR applies to EU citizens even if they’re residing in the U.S. You may have noticed that many companies have recently notified customers about updates to their privacy policies based on the GDPR’s mandates. If you already have a standard privacy policy in place on your website and your business is active in the EU, you may need to do the same thing.
6. Is your Standard Privacy Policy Current?
Data breaches make news headlines with alarming frequency these days. Lawmakers then scramble to draft laws in response that provide consumers with more protection as new vulnerabilities are discovered. Due to the quickly changing nature of technology, these laws are constantly being enacted and revised. This ever-changing legislation is another reason to consult with an attorney when you’re drafting your standard privacy policy. Be sure to let your attorney know that you want a current policy and you also want to be updated whenever a change in the law requires a change in your policy language.
At VineLegal, you can request a professional drafting and updating of your website/blog's standard privacy policy. We also have offers for a long-term legal guidance regarding website privacy policy as laws and regulations continue to evolve. You can reach out to us here to request a standard privacy policy document
Post a Comment