I'm concerned primarily about the US, but also UK and Germany.
Is there any way to give a privacy policy greater trust, and more effectiveness, by somehow binding it to a company's bylaws with the state?
asked Jul 19, 2017 at 23:38
-
In what way do you think it is ineffective? In all the cases I have seen of users against websites or services the privacy policy was the strongest card in each one. If a company does not hold to that policy it can be considered fraud. Maybe I don't understand what you mean.– NalaurienJul 19, 2017 at 23:51
-
I'm not saying it's ineffective, however I can't consistently say that every website with a privacy policy actually adheres to it. I'm sure a variance exists. I'm exploring how I can prove I'm one of the good guys. An EV certificate would prove my country and perhaps my D&b business record.... Resident in a country applicable to the privacy policy.– makerofthings7Jul 19, 2017 at 23:57
-
Perhaps I should reword to include: how do I trace a company name in a privacy policy to ensure its properly domesticated for my data ?– makerofthings7Jul 19, 2017 at 23:59
-
That would be a new question which you should ask separately (although I am not sure if it's even on-topic here).– PhilippJul 20, 2017 at 13:21
Add a comment
|
2 Answers
The common way to ensure customers that you actually respect your own rules is to ask a third part to audit and certificate your business. If it is important for you, ISO provides a bunch of normative document that certification organization know. The best known is ISO 9001 for general Quality Management, and the IT counterpart is ISO 27001.
So my opinion is that the best proof you can provide to you customers is a ISO 9001 + ISO 27001 certification.
answered Jul 20, 2017 at 9:19
The best way you can gain public trust in your privacy policy is by being as transparent as possible. Include the plain text version, but also include a page that breaks down each section in easy to understand text and gives supplemental information on how it's implemented.
Incorporating the policy in the corporate bylaws in my opinion is meaningless to the average user. While you can already be sued for violating your privacy policy in the US, the implementations of adding it to your bylaws vs not should be discussed on the Legal StackExchange.
