660 VIEWS
Pinterest LinkedIn LINE

When you use services such as Facebook or Google, do you properly read their terms of service and privacy policies?

I do not. Well, I read Facebook’s and Google’s, but almost none of the others. You go there because you want the service; nobody can realistically read terms dozens of pages long.

Providers surely know customers do not read them, so whether such consent is meaningful is highly questionable.

This situation is unfortunate for providers and users alike.

One response is the Kantara InitiativeAdditional explanatory information.Information Sharing Work GroupAdditional explanatory information.Standard Information Sharing Label called the Standard Information Sharing Label. Like a food-ingredient label, it seeks to show in a standardized format what is shared, how, and for what purpose.

The American Nutrition Facts Label looks like this.

Source: http://en.wikipedia.org/wiki/Nutrition_facts_label

This lets you see at a glance, for example, that it contains 12 grams. The Standard Information Sharing Label presents information similarly.

Standard Information Sharing Label

The data recipient seeks to collect your information for the following purposes.
Recipient Facebook  (http://www.facebook.com/)
Information collected Status update [View the actual information]
Source Status update [
Time of collection When the Post button is pressed
Purposes of use 1To share your status with friends.2To display advertising customized for you.
Retention period Until all original data and shares are deleted
Recipients of disclosure Your and your friends’ timelines, and applications authorized for read_stream that use Facebook’s OpenGraph API.
Additional terms
Underlying agreement April 26, 2011 dated https://www.facebook.com/legal/terms
Third-party rating Rating Company 4.3/5 (2011/11/4)
Changes to terms Changed after 7 days’ notice, with limited exceptions

SourceJoe Andrew “Standard Information Sharing Label”; translated and adapted for this site from

This may still be difficult, but it is far better than reading a lengthy contract.

They hope to make the design cooler. A Kickstarter fundraiser to hire a designer was cancelled after raising only about ¥500,000 . Are any designers willing to create the Japanese version pro bono?

Anyone may join the Kantara Initiative Information Sharing WG doing the actual work. Interested readers may wish to participate.

Applying It in Practice

Let us apply it to an example company.

Standard Information Sharing Label

The data recipient seeks to collect your information for the following purposes.
Recipient Example Corporation
Information collected
  1. Items on the customer registration form and login-ID application or amendment: name, sex, date of birth, address, telephone number, email address, and similar data
  2. Usage history at point-program participating companies
  3. Login-ID or card suspension, withdrawal, and other matters concerning suspension or expulsion
  4. Information on the award or use of points
  5. Credit-card number
  6. Other descriptions, individually assigned numbers, symbols, or other codes
  7. Images or audio that can identify an individual
  8. Details of service use
  9. Browser type and version, operating system, platform, browsing and purchase history, and other service history collected automatically upon site access
  10. Inquiry information
  11. IP address used by the member’s computer and contracted-device data from mobile access
  12. Location information from mobile devices
  13. All information provided when using new services

View the actual information
Source
  1. Membership application
  2. Point-presenting terminals and login-ID entry destinations
  3. Member-information analysis database for the point service
Time of collection
  1. When applying for membership
  2. When a member enters a login ID or presents a card at a participating company
  3. When analyzing member lifestyles
Purposes of use
  1. Additional explanatory information.1 of Article 2 for smooth operation of member services, including the point program, represented by the matters stated in paragraph
  2. To transfer to a successor program and perform related work when the point program changes
  3. To analyze member lifestyles
  4. ; translated and adapted for this site from
  5. Inquiry information
  6. Purposes of use
Retention period Purposes of use5 described above.
Recipients of disclosure
  • Our consolidated and equity-method affiliates
  • Additional explanatory information.list）

Purposes of use
Additional terms
Underlying agreement October 1, 2011 dated http://www.example.com/member/agreement/
Third-party rating Rating Company 4.3/5 (2011/11/4)
Changes to terms 1The revised terms are announced on our website with at least

This is easier than reading the contract, and it exposes problems. I would hesitate to consent for roughly the following reasons.

  1. Recipients of disclosureRecipients of disclosure2012/6/20Additional explanatory information.134 brands and 46,548 stores appear to accept it.
  2. Recipients of disclosureThe joint users are all point-program participants. Although I understand raw data is not actually shared before k-anonymization, the terms permit it. A standard label should name major companies and the total count. As of
  3. Too much information is disclosedAll information may be shared. Behavior across companies may be tracked and used to build and share an unwanted lifestyle profile. Multiple cards might control this, but it is unclear; explicit disclosure would be reassuring.
  4. Changes to termsChanges to terms1 days, notice is only on a website I probably will not visit, and revised terms apply automatically. Google permits changes at any time but requires explicit consent for detrimental changes.
  5. Retention periodAlthough limited to inquiries, data appears never to be deleted. A deadline is appropriate; credit bureaus, for example, use periods such as 18 months.

The Google Example

; translated and adapted for this site from

Standard Information Sharing Label

The data recipient seeks to collect your information for the following purposes.
Recipient Google Inc.
Information collected
  • At Google Account registrationView the actual information
  • Information collected when using services
    • Device information
    • Server-log information
      • Details of Google service use, such as search queries
      • Telephone logs, including numbers, date, time, duration, SMS routing, and call type
      • Internet Protocol address
      • Device-event data, including crashes, activity, hardware, browser, language, request time, and referring URL
      • A Cookie identifying your browser or Google Account
    • Location information
    • Unique application number
    • A Cookie identifying your browser or Google Account
Source
  1. Google Account registration form
  2. During service use
  3. Google Account and Google+ registration data
  4. Sites using Google Analytics
Time of collection
  1. At Google Account registration
  2. During service use
  3. Sites using Google Analytics
  4. When visiting a site using Google Analytics
Purposes of use
  1. To provide, maintain, protect, and improve services, develop new services, and protect Google and users
  2. To provide customized content, such as more relevant search results and ads
  3. To display your name and profile information across Google services requiring an account
  4. To help resolve problems you may have
  5. To improve your user experience and overall service quality
Retention period Until you delete it, at no charge, except where deletion requires excessive technical effort, threatens another person’s privacy, or is extremely impractical, such as backup-tape requests.
Recipients of disclosure
  • People with whom you share the information
Additional terms
  • A Cookie identifying your browser or Google Account
  • Privacy concerns differ. Google aims to disclose what it collects and let you choose how it is used. For example:
    • Use Google Dashboard to review and manageAdditional explanatory information.
    • Use Ads Preferences Manager to view and editYou can configure your browser to block all Cookies, including Google Cookies, or notify you when Google sets one. Disabling Cookies may prevent many services from working properly, including retaining language settings.
    • Use Google’s editor to review and change the profile shown to particular people.
    • Additional explanatory information.controlAdditional explanatory information.
    • Additional explanatory information.export informationAdditional explanatory information.

    A Cookie identifying your browser or Google Account
Underlying agreement October 1, 2011 dated http://www.example.com/member/agreement/
Third-party rating Rating Company 4.3/5 (2011/11/4)
Changes to terms At any time, except that changes reducing your rights will not be made without your consent.

What do you think? The original is already clear, but easier side-by-side comparison is valuable.

Future Issues

Applying the label exposes further issues. Google’s “as-if-owner” clause is in its terms, not privacy policy, and is invisible here. It lets Google act much like an owner of uploaded content. To quote:

Some Services allow users to submit content. You retain ownership of intellectual-property rights in that content; what belongs to you remains yours.

When you upload or otherwise submit content, you give Google and its partners a worldwide license to use, host, store, reproduce, modify, create derivative works, communicate, publish, perform, publicly display, and distribute it. These rights are limited to operating, promoting, and improving the Services and developing new ones. The license continues even after you stop using the Services. Some Services let you access and delete submitted content or limit Google’s use. Ensure that you have the rights needed to grant this license.

Additional explanatory information.1 says that what belongs to the user remains theirs, but paragraph 2 grants Google a perpetual license covering most copyright rights. Together, paragraphs 1Additional explanatory information.2Purposes of use1Future Issues

 

[1] Facebook appears not to have this limitation. Its license is quoted in English above. Although privacy and application settings provide control, the exception where others have shared and not deleted content matters, and public content seems hard to control. Someone should investigate this closely.privacy and application settingsAdditional explanatory information.

Related posts