Australian Business Advisers
Privacy Survey

Which Australian web sites care about your privacy?

Melbourne - Survey finds very few Australian corporate and consumer web
sites have privacy policies. Some large and popular web sites actually have
non-privacy policies.

According to a 1998 BusinessWeek survey, privacy was found to be the number
one consumer issue facing the Internet - of more concern than cost, ease of
use, security, or spam. Some people believe that concerns about lack of
privacy are slowing the growth of e-commerce. So which Australian web sites
have privacy policies?

According to a groundbreaking survey of Australia's top 100 companies (by
market capitalisation) only 5% of the 79 companies that have a web site
have an online privacy policy. Similarly in a survey of the 50 Australian
Web Sites most accessed by Australians (from
http://usrwww.mpx.com.au/~ianw/) only 20% mention anything about the
privacy of your information. And some of these privacy statements could
more correctly be described as non-privacy policies.

Amazingly, only 6% of the 129 web sites surveyed by Australian Business
Advisers promised not to disclose your personal information. Eighty eight
percent of sites did not mention anything about what they would do with any
information collected from users. And disturbingly, 5% of web sites stated
that any and all information collected was deemed to be non-confidential
and can be used in any way they chose, including disclosure to others
"without limitation".

"Many companies need to wake up," said Rod Brooks, Senior Consultant with
Australian Business Advisers, who conducted the surveys. "Online privacy
concerns are real and need to be addressed. Web sites should tell people
what information is being collected, how it will be used, what choices are
available regarding collection, use and distribution of their information,
the security procedures in place to protect users' collected information
from loss, misuse or alteration, and how users can update or correct
inaccuracies in their information."

"For most companies the lack of a privacy policy is more likely to be due
to not seeing it as a priority rather than anything sinister, but people
should have some concerns about the use of information statements on a
number of web sites," added Brooks.

One top 100 company has the following quote in its Copyright, TradeMarks
and Disclaimer section:

"Any information, ideas, concepts, know-how or technologies provided by or
obtained from you or your use of [named company's] web site shall be deemed
to be non-confidential and [named company] shall be free to reproduce, use,
disclose and distribute the information to others without limitation."

Whilst some of these conditions may be designed to protect the company from
breach of copyright suits by people claiming to have given them commercial
ideas over the Internet, there is no mention of the exclusion of personal
information. "As this site allows the payment of bills by credit card does
this mean they can share the credit card information with anyone?" asked
Brooks.

Similarly a number of very popular web sites have the same Terms of Use
which includes the following quote:

"[Named company] and its affiliates may gather, process and use (and allow
others to use): a) the information which you submit or otherwise provide
when using the Network (including your name, physical address, email
address and any other details you provide), b) information regarding the
manner in which you use the Network (including without limitation all
information gathered as a result of the use of "cookies"). From time to
time, [named company] may offer and may allow others to offer products and
services to you. If you wish to discontinue receiving such offers please
contact as appropriate [named company] or the relevant affiliate."

"As this information is not prominently displayed where people provide this
sort of personal information, I wonder how many people realise that their
personal details can be disclosed to others?" asked Brooks. "And a good
privacy policy should provide contact details for exactly who to contact to
opt out."

Many web sites ask for personal details for any query or even for feedback.
Often this information is optional but rarely is this revealed. "These
sites should disclose how this information will be used," said Brooks.
"Only three web sites were found to disclose what information is being
collected and how it will be used ­ www.newscorp.com.au, www.yahoo.com.au
and www.altavista.yellowpages.com.au. Five sites had less comprehensive
privacy policies which explained in detail either what is being collected,
or how it will be used, but not both ­ www.aristocrat.com.au,
www.bankwest.com.au, www.battleofthesexes.com.au, www.start.com.au, and
www.tradingpost.com.au. Seven sites said that any information provided was
not confidential and could be disclosed to others."

Privacy has become such a big issue that IBM plans to withhold advertising
dollars from North American sites that do not post privacy policies. IBM
estimates just 30% of the 780 web sites on which it advertises worldwide
display a privacy statement. The USA Direct Marketing Association will deny
membership to any company that does not comply with its privacy pledge.
This includes posting privacy statements on web sites. And Microsoft and
TRUSTe are developing a Privacy Wizard to simplify the process of
implementing an online privacy policy (see
http://privacy.linkexchange.com).

Speeding up the crucial processes of enabling users to set their own
privacy boundaries and letting sites post privacy policies is critical to
helping e-commerce grow and heading off government regulation, according to
Tara Lemmey, president and executive director of the Electronic Frontier
Foundation.

"So Australian web sites have a responsibility to quickly develop, post and
implement privacy policies," concluded Brooks.

About the survey

A single surveyor in April 1999 visited the web sites of the top 100
Australian companiesby market capitalisation (as listed on
www.kangaroo.com/companies (Please note this site appears to be undergoing redevelopment and may not be available)). Seventy nine of these top 100 companies had web sites. The 50 Australian Web Sites most accessed by Australians (from http://usrwww.mpx.com.au/~ianw/) were also visited. At each site the surveyor made reasonable efforts to find any statement relating to privacy of personal information. This included examining pages such as disclaimer, copyright, legal, terms of use, and about this site. Any privacy statements were examined for references as to what information is being collected and how it will be used. It is acknowledged that some privacy policies on some sites may not have been found, and that other surveys at different times may yield different results.

For more information, please e-mail Rod Brooks on rod@abaconsulting.com.au