An online company's privacy practices vary due to the fact that it offers a wide variety of services. How could it best address the concern that explaining them all would make the policies…

Question

Options

• AUse a layered privacy notice on its website and in its email communications.
• BIdentify uses of data in a privacy notice mailed to the data subject.
• CProvide only general information about its processing activities and offer a toll-free number for
• DPlace a banner on its website stipulating that visitors agree to its privacy policy and terms of use

• A
  73% (27)
• B
  16% (6)
• C
  3% (1)
• D
  8% (3)

Explanation

The GDPR requires that the information provided to data subjects about the processing of their personal data must be concise, transparent, intelligible and easily accessible, using clear and plain language. However, this can be challenging when the processing activities are complex, diverse or voluminous. Therefore, a good practice is to use a layered privacy notice, which consists of providing a short notice with the key elements of the privacy information, such as the identity of the controller, the purposes and legal basis of the processing, the recipients of the data, the data subject's rights, and the contact details of the data protection officer or the supervisory authority. The short notice can then contain links to more detailed information, either by expanding each section or by directing the user to a separate page or document. This way, the user can easily access the information that is most relevant or important to them, without being overwhelmed by a long and complex notice. A layered privacy notice can be used on websites, in emails, in mobile apps, or in any other medium where space or attention span is limited.

No community discussion yet for this question.