Among those that did provide such information, Cnil said the info was too general and often focused just on one aspect, such as the use of cookies. The regulator noted important information was often missing across all the sites and apps, such as how the personal data will be used, whether it will be passed on to third parties or the rights of the person submitting the data. Often the information is also buried in the site or app's general terms and conditions, making it difficult for users to find and understand.
Cnil did find some sites with better practices, such as providing FAQs on their data policies and contacts for users to get more information. It noted that among the 250 French sites checked, only 10 percent were missing information on their collection of personal data.
CNIL said it and the other regulators will be contacting the sites falling short of the law, known in France as the Law on Information Technology and Freedoms and based on the EU data protection directive. If they do not improve the information on personal data collection, they may face sanctions.
The operation 'Internet Sweep Day' checked in total 2,180 sites and applications, including the most popular in each country. The GEPN includes most EU regulators, as well as their counterparts in the US, Switzerland, Ukraine, Korea, China, Israel, Mexico, Norway, New Zealand, Australia and Canada.
