Media Statements

Privacy Sweep Spots Concerns over Personal Data Collected by Websites and Apps Targeting Youngsters

(4 September 2015) The Office of the Privacy Commissioner for Personal Data, Hong Kong (PCPD) took part in the Global Privacy Enforcement Network¹ (GPEN) Privacy Sweep² (the "Sweep") to examine websites and mobile applications (apps) used by youngsters. Results of the Sweep have raised concerns over the personal data collected, in particular how much personal data was collected and how it was then shared with third parties.

The Sweep

This year, 29 privacy enforcement authorities from around the world, including the PCPD, surveyed a total of 1,494 websites/apps targeted at, or popular among, youngsters from 11 to 15 May 2015. The PCPD conducted similar exercises in 2013 and 2014 to look at the issues of privacy policy transparency associated with mobile apps.

Common Concerns

The 2015 Sweep highlights are:

• 67% of the websites/apps examined collected youngsters' personal data. Of particular concern were the significant number of websites/apps which collected potentially sensitive personal data, such as name, date of birth, phone number, address and photos or video;
• 78% of the websites/apps failed to use simple language or to present warnings that youngsters could easily read and understand;
• Only 31% of the websites/apps had effective controls in place to limit the collection of personal data from youngsters. Particularly troubling was the fact that 58% of websites/apps offered youngsters the opportunity to be redirected to a different website, where they could be asked to disclose personal data;
• 51% of the websites/apps shared personal data with third parties, in some cases for vague or unspecified purposes;
• Only 24% of the websites/apps encouraged parental involvement; and
• 71% of the websites/apps did not offer an accessible means for deleting account information.

Good Practice

The Sweep also found examples of good practice:

• Some websites/apps provided effective protective controls, such as parental dashboards showing youngsters' online activities, or pre-set avatars to prevent youngsters excessively sharing their own personal data;
• There were chat functions which only allowed youngsters to select words and phrases from pre-approved lists instead of typing freely, so that youngsters could not disclose their personal data inadvertently;
• Some websites/apps use just-in-time warnings to deter youngsters from unnecessarily entering personal data; and
• 15% of the websites/apps had age verification to bar younger children from accessing the websites/apps.

Privacy Commissioner for Personal Data Mr Stephen Wong said, "The PCPD recognises that youngsters are the most active users of computers, smartphones and social networks. Whether youngsters are provided with an appropriate level of protection online remains an ongoing issue for privacy enforcement authorities. Website/app developers are expected, if not obliged, to develop and present a user-friendly protective privacy environment for youngsters. We will consider whether further action is needed against the findings made after the Sweep, including enforcement actions."

"Youngsters are frequently identified as one of the most vulnerable groups. Stepping up education efforts for youngsters will be one of our strategic focuses in the near future. We will continue to develop diversified programmes to draw the attention of youngsters and parents to the importance of personal data protection. It has become essential for them to fully understand the privacy risks associated with online activities and take proactive vigilance and security measures before providing any personal data," he added.

The PCPD will announce later the results of the Sweep in detail with respect to local websites/apps.

Data users who collect personal data on websites/apps are encouraged to read
"Guidance for Data Users on the Collection and Use of Personal Data through the Internet" at
www.pcpd.org.hk/english/resources_centre/publications/files/guidance_internet_e.pdf and
"Best Practice Guide for Mobile App Development" at
www.pcpd.org.hk/english/resources_centre/publications/files/Mobileapp_guide_e.pdf.

Members of the public may refer to the PCPD's guidance "Protecting Online Privacy –
Be Smart on Social Networks" at
www.pcpd.org.hk/english/resources_centre/publications/files/SN_e.pdf,
"Protect Privacy by Smart Use of Smartphones" at
www.pcpd.org.hk/english/resources_centre/publications/information_leaflet/flipbook/
leaflet_smartphone/index.html,
"Using Computers and the Internet Wisely" at
www.pcpd.org.hk/english/resources_centre/publications/files/computer_wisely_e.pdf and
"Youth Privacy Portal" at www.pcpd.org.hk/youthprivacy.

- End -

¹ www.privacyenforcement.net

² Media statement about background on the Sweep:
www.pcpd.org.hk/english/news_events/media_statements/press_20150511.html