6

Disclaimer: I'm aware my question is a bit far from IT security practices but here is the most appropriate place I can think of to post my question within the whole stackexchange.

Let's say, many companies and websites post their privacy policy, normally in a link named 'privacy' or similar at the bottom. In such a privacy policy, many aspects are provided, e.g. information collection, sharing, disclosure, retention, security protect, etc.

However, I want to know, if a company/website deceptively practice against its stated privacy policy, what are the consequences?

For my knowledge, e.g. in the US, Federal Trade Commission can bring action against such practice. What about Europe? And what about other aspects rather than legal?

Improve this question
6
  • In Germany the privacy commissioner may start an investigation which can end in the company being fined. But I guess, the bad press coverage is far worse.
    – Hendrik Brummermann
    Oct 23, 2011 at 13:40
  • @HendrikBrummermann Hi Hendrik, thanks a lot for this info! What, in more specific, is the name of the privacy commissioner? And do you know any general info on the EU level. I know this are few EU Directive focus on data privacy and security, but I have no idea about how they react on real deception. E.g. who are counterparts as the US Federal Trade Commission in Germany or EU?
    – Flake
    Oct 23, 2011 at 13:54
  • the national privacy commissioner of Germany is Peter Schaar. The one of the state Schleswig-Holstein, who got a lot of media attention because of his investigations against companies, which transmit informations to Facebook without a data processing agreement that fulfils the requirements of German law, is called Thilo Weichert.
    – Hendrik Brummermann
    Oct 23, 2011 at 14:30
  • 2
    It's important to note that complying with European privacy regulations is not sufficient for a European company, but it has to comply with all the privacy regulations on all levels (Europe, national, and state).
    – Hendrik Brummermann
    Oct 23, 2011 at 14:31
  • @HendrikBrummermann Thank you for this information. :)
    – Flake
    Oct 23, 2011 at 19:59

2 Answers 2

Reset to default
5

In most cases the provider will do the minimum necessary for compliance - be it compliance with legal requirements or with the binding industry standards they require to operate (such as PCI-DSS). If you have evidence that the provider is not complying with these requirements then the route to address these would be via the body which sets out these requirements. However I suspect that proving non-compliance would be rather difficult in most cases.

All the countries in the EU have very specific requirements regarding data privacy. And certainly within the UK there have been several instances of companies being fined for non-compliance with the data protection act.

However (IANAL) there is also a contractual issue between the provider and the user if the provider makes false claims about the security it provides. But since the provider is unlikely to go any further than the requirements previously described, then its unlikely that you'd need to exercise your options in this scenario.

Improve this answer
0

IMO, it is senseless to ask about deceptive practices against STATED privacy policy.
At which moment of deception according to which policy at what time? when the policies of online service are being retroactively, unilaterally, declaratively and without notices (notifications) changed on a weekly basis?

Any statements that contradict laws are null. Policies, by contrast to contracts, are just declarations (or good will, or intentions), they are not bound by obligations.

In case if a side breaks a promise, then the follows simple question:
why have not a licensee stopped using broken license?

If a policy contradicts to laws then it is more than probably scam scheme.

There is a sense to worry about real practices (not just wishes) against real laws, but this is another question or rather, due to multide of laws and providers, questions.

Update:
There was an earlier relevant discussion here: What happens with a subpoena and a system designed to protect itself from you? on this board about a complaint submitted to the FTC (Federal Trade Commission) on May 11, 2011, the popular cloud-based data storage provider Dropbox, Inc. made false claims about the security of its users’ data, thereby putting them at risk while gaining an unfair advantage over competitors that actually offer the sort of security Dropbox advertised.

IMO, maximum what FTC can make is to oblige DropBox either to change its claims to non-deceptive or to change its functionality to comply with its declarations (policy).

I googled about in an attempt to find about the decision/response of the FTC to complaint and couldn't find any though there are a lot of discussions about complaint.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .