The Datatrust Approach to a Clear Privacy Policy

Most users of online services haven’t and probably never will read the privacy policies that have been carefully created by teams of lawyers at large companies. Essentially, these policies tell us what we already know: a lot of data is being collected about us, and it’s not really clear who gets to use that data, for what purpose, for how long, or whether any or all of it can eventually be connected back to us.

Yet, we still use Google, Microsoft, Yahoo, and all those other websites without giving a second thought to giving up all of our personal data to those companies.

The Common Data Project (CDP) is a not-for-profit organization working to develop new ways to deal with sensitive information in a transparent, responsible and participatory manner. It intends to raise the industry standards for anonymization of data. CDP intends to encourage and enable the disclosure of personal data for public reuse through a technology and legal framework for anonymized data-sharing. This would be done through an institution called a datatrust, which is a trusted place to store and share sensitive personal data. At the heart of a datatrust would be an easy-to-understand, clear-cut privacy policy.

Identifying the Crucial Issues

CDP used the following questions to help identify the issues that were most crucial for ensuring users’ privacy:

  • What data collection is happening that is not covered by the privacy policy?

Much of the data collection that is taking place actually isn’t covered by the privacy policy. That this is news to users simply draws attention to the gap between user understanding and company practices.

  • How do they define personal information?

Most privacy certification programs, such as TRUSTe, require that the privacy policy identify the kinds of personally identifiable information (PII) are being collected. Hence, almost every privacy policy will include a lengthy list of the types of information being collected. Certain companies categorize, others label, and still others use this disclosure to boast that they collect no information whatsoever.

  • What promises are being made about sharing information with third parties?

Most privacy policies will provide reasons for collecting data from users. Common reasons are as follows:

  • To provide services (e.g. customer service)
  • To operate the site/ensure technical functioning of the site
  • To customize content and advertising
  • To conduct research to improve existing services and develop new ones

Another common practice is to list the circumstances in which data is shared with third parties. The most common include:

  • To provide information to subsidiaries/partners that perform services for the company
  • To respond to subpoenas, court orders, or legal process, otherwise comply with law
  • To enforce terms of service
  • To detect/prevent fraud
  • To protect the rights, property, or safety of the company, its users, or the public
  • Upon merger or acquisition
  • What is their data retention policy and what does it say about their commitment to privacy?

Data retention has been an important issue for years, with many American companies failing to meet the strict standards of the European Union.

Most privacy advocates believe that limiting the amount of time data is stored helps to reduce the risk of exposure. The idea is that sensitive data is like toxic waste; the less of it around, the better off we are. However, this fails to address the fact that our new abilities to collect and store data are incredibly valuable, not just for major corporations, but for policy makers, researchers and the average individual. Focusing on the issue of data retention hasn’t led to improved privacy protections, rather it may even be distracting us from developing better solutions.

  • What privacy choices do they offer to the user?

In recent years, we’ve seen some interesting changes in the way some companies view privacy. They are starting to pick up on the fact that people actually care about the information that’s being collected about them.

  • What input do users have in changing the policy’s terms?

Unsurprisingly, none of the privacy policies the CDP examined offered the option for users to make chances to the privacy terms.

  • To what extent do they share the data they collect with users and the public?

The study doesn’t just stop at finding out what the existing privacy policies are saying. In a larger context, it’s important to understand the types of promises companies are making about users’ privacy. How do the large online companies view data? Is it something that belongs to them as soon as they get their hands on it? What are the various factors that shape attitudes towards user privacy?

A look at the landscape

According to CDP, none of the privacy policies they looked at really made the cut. Most of them provide unclear or incomplete information on what they meant by “personal information,” while others failed to even mention that they are actively sharing information with third-parties. Even when they change their policies on something like data retention to placate privacy advocates, the changes do very little to provide real privacy. The legal right companies reserve to change their policies at any time just draws attention to the fact that the balance of power leans in their favor. When they do offer users choices, these options fail to encompass all the ways online data collection implicates users’ privacy.

Changes in the right direction

However, there are positive signs that companies are making the right choices, as far as user privacy goes. Maybe they’re finally realizing that they need buy-in from their users to survive over the long-term.

During the most recent Facebook fiascos, we’ve seen users attempt to determine how their data is being shared. Google has created new tools that allow users a wider range of choices for controlling how their data is tracked. Each day, we’re seeing new examples of how data can be shared with users and customers as part of a service, rather than being treated as a mere byproduct that is solely for the companies’ use and enrichment.


This article looks at the notion of a datatrust, first proposed by the Common Data Project (CDP). This refers to a repository of sensitive information donated by institutions and individuals for public use. The CDP carried out a study of major online companies to assess the state of their privacy policies.

CIPP Exam Preparation

In preparation for the Certified Information Privacy Professional/Information Technology (CIPP/IT), a privacy professional should be comfortable with topics related to this post, including:

  • Privacy by policy (III.B.)
  • Policy components (IV.A.a.)

Leave a Reply




You can use these HTML tags

<a href="" title=""> <abbr title=""> <acronym title=""> <b> <blockquote cite=""> <cite> <code> <del datetime=""> <em> <i> <q cite=""> <strike> <strong>