When you do internet banking, buy clothes from a webshop or accept a website's cookies, you share some of your personal data. But what happens to your data next? How long is it kept, and who does the recipient pass it on to? Most of us don't dwell on such questions much. If we do start to wonder, the answers usually turn out to be buried in a dense, jargon-filled privacy statement.
Now Privacy Company and Pineapple Jazz have teamed up with ECP and SURF to change all that by creating Privacy Label: a tool that generates a short, reader-friendly explanation of how an organisation deals with personal data. With Privacy Label, all the key information from a corporate privacy statement is presented in a clear visual form. Privacy Company's Consultant Coen Steenhuisen talks about the Privacy Label project, collaboration with SIDN Fund , and what happens next.
List of ingredients
Arrival of the EU's General Data Protection Regulation (GDPR) created the need for standardisation or an icon system to make the AVG understandable. An initiative to devise a set of GDPR icons prompted the Electronic Commerce Platform (ECP) to ask, who can turn this idea into the workable system that the community needs? In consultation with ECP and Pineapple Jazz, Privacy Company put forward an outline, and the Privacy Label project was born. "We soon discovered that privacy, data protection and legislation are too complex to be reduced to a handful of icons. So we built a labelling system to get across the key information," recounts Coen Steenhuisen. He likens the system to the way that food products are labelled. "On a cereal box, there's a list of ingredients. That list is just a summary, to tell the consumer the basics. It says what the product is made of, but it doesn't go into any great detail. It's also strictly factual and neutral -- unlike, say, a product approval mark. It doesn't say anything about whether your breakfast cereal is sustainably produced, for example." A privacy label isn't an alternative to a privacy statement. It's a brief, eye-catching summary of the information that your privacy statement contains. And any consumer who wants the full facts can always click through to the privacy statement proper.
Coen Steenhuisen, consultant at Privacy Company and project manager of the Privacy Label project.
Labelling information
Privacy Label still uses icons, but alongside standard elements indicating what data is obtained, how, for what purpose, how it moves through the receiving organisation and where it ends up. Is data shared with anyone else or passed on to the government? And how long is it kept? "Privacy Label helps companies do GDPR communication better. It's completely customisable to the company's house style, so that it can be seamlessly integrated with other corporate communications," explains Coen. Privacy Label is currently still in the development phase. A test version has been developed and piloted, mainly to gather information about companies' requirements with regard to privacy statements. "Through the SURF network, we approached a number of universities, colleges and training centres. There's a lot of interest from players in that sector, who will bring a particular perspective to the project, providing us will a fuller picture of what's needed," says Coen. "A second pilot has now been started, which is focusing on what privacy information a website user wants to see."
Taking Privacy Label to the next level
One reason why SIDN Fund was pleased to support the Privacy Label initiative is that it makes the GDPR more useful in everyday life, according to Mieke van Heesewijk, Programme Manager at SIDN Fund. "It helps everyone," she says. "It helps companies and other organisation that handle personal data by making it easier to provide clear information. And it helps internet users by giving them an at-a-glance summary of what's going to happen to their data. As well as informing people, Privacy Label therefore promotes privacy awareness."
Mieke van Heesewijk, Programme Manager at SIDN Fund
Thanks to SIDN Fund's support, Coen and his team have been able to take the first prototype of Privacy Label to the next level. "SIDN Fund doesn't simply give us money; they also provide valuable input through interaction that is both inspiring and informative," says Coen. "We are now working on a tool that can be used to build an operational version of Privacy Label."
Looking to the future
Privacy Label's project team is also talking to firms that make privacy management software about the possibility of integrating Privacy Label into their products. "Our dream is for Privacy Label to be adopted by the Dutch Data Protection Authority and the European Data Protection Board as a standard requirement, so that every data-processing organisation has to have a label as well as a formal privacy statement." Interested in how the Privacy Label project is going? Fancy using use Privacy Label yourself? Visit www.privacylabel.org for full details.