0

My website is hosted in the U.S. but I am using it for my professional services in Europe.

The website uses only technical cookies and anonymized analytics (Google Analytics).

What should I specify in my privacy policy, except that these technical cookies and anonymized analytics are used?

2
+50

I'll attempt to point you in the right directions here, while of course please be aware that it's merely a very very general answer. Even though European legislation is currently "harmonised" via a Directive that mandates implementation into national laws, it still has its implementation peculiarities.
Also, as usual, here goes the warning that this answer is for informational purposes and not for specific legal advice. So if you really need to further investigate, it is advisable to seek the assistance of a lawyer specialised in this particular practice of law. To some extent iubenda might be helpful, which is the company I work for and which is the main reason for some of my background/experience in the area.

Let's start with the simplest and most likely option: the UK.

The UK, being part of the EU takes a lot of their privacy related rules from European directives. The so called EU Data Protection Directive 95/46/EC has been implemented in March 2000 with the Data Protection Act 1998. Enforcement falls to the ICO, the Information Commissioner’s Office.

In general, they advise to inform about these things at least:

  1. make sure people know who you are,
  2. what you intend to do with their information,
  3. who it will be shared with or disclosed to

Depending on the circumstances you may decide to go beyond the basic requirements of the law, for example by telling people:

  • If you intend to pass information on, the name of the organisations involved and - details of how they will use the information
  • how long you or other organisations intend to keep the information
  • whether replies to questions are mandatory or voluntary
  • the consequences of not providing information - for example, non-receipt of a benefit;
  • whether the information will be transferred overseas;
  • what are you doing to ensure the security of personal information;
  • about their rights and how they can exercise them - for example, the fact that a person can obtain a copy of their personal information or object to direct marketing;
  • who to contact if they want to complain or know more about how their information will be used;
  • and about the right to complain to the Information Commissioner if there is a problem

The above is based on a manual released by the ICO. You must also be aware however, that within a year new rules will be introduced based on a real pan-European regulation called the GDPR.

Now that we have the main structure together, we can see about the cookies.

Technical cookies

Technical cookies famously don't require the users' consent ahead of time. However it's definitely good practice to still point that out within your privacy policy or cookie policy (likely also required). However since you're making use of cookies outside of the absolutely necessary - Google Analytics - you're required to inform about cookies anyway.

When setting cookies you're required to - tell people that the cookies are there, - explain what the cookies are doing, and - obtain their consent to store a cookie on their device.

The ICO provides an example section for wording:

Our website uses four cookies. A cookie is a small file of letters and numbers
that we put on your computer if you agree. These cookies allow us to 
distinguish you from other users of the website which helps us to provide you 
with a good experience when you browse our website and also allows us to 
improve our site.

The cookies we use are ‘analytical’ cookies. They allow us to recognise and 
count the number of visitors and to see how visitors move around the site when
they’re using it. This helps us to improve the way our website works, for
example by making sure users are finding what they need easily. Read more
about the individual analytical cookies we use and how to recognise them [link]

I'm linking you to the ICO's cookie guidance document if you want those deeper insights.

Google Analytics: Cookie blocking for more intrusive types

The implementation of the cookie law still vary heavily, the ICO's stance can be counted among the very permissive ones. There are more strict systems like the one by the French CNIL, Spain, Italy and more.

Based on those you must block these cookies (Google Analytics) before the user has given you their consent. In Germany and other countries the IP anonymisation is table stakes. It must be done by default.

France, for instance, allows Piwik to be there without the need of initial consent, while Google Analytics needs consent. Others might be more permissive.

If you run that business across many countries, it might make sense to just take the strictest approach: block these cookies before user consent (we've built something to help with cookie management at iubenda).

Another topic entirely might be the newly developed Privacy Shield, which I personally wouldn't be able to get into more deeply.

Hope this all helps.

  • Thank you for your answer. I will look into the answer these days, calmly and then eventually accept it. In the meanwhile, would you elaborate a bit on the GDPR? (that's my big doubt right now in fact) – dragonmnl Jun 12 '17 at 10:41
  • No problem, @dragonmnl. In your shoes I'd probably look into GDPR closer to its release since good documentation is still a bit scarce. The best info (a bit surprisingly so) is indeed the one linked to in the body by the ICO. – Simon Jun 12 '17 at 16:27
  • Couldn't edit the comment: here's a link directly to the parts relating to information ico.org.uk/for-organisations/data-protection-reform/… – Simon Jun 12 '17 at 16:34
  • Thank you. very clear information (and thanks for the advice on GDPR). However you didn't answer to the part "hosted in US, used in EU". can you elaborate just that? – dragonmnl Jun 12 '17 at 20:16
  • Yes sure, I didn't elaborate on the hosted part because I think it may be mostly irrelevant. If you directly target European users, collect their data, it doesn't matter so much where the site is hosted. To be fair though, I think you're going much farther with your thinking already than most any US site owners. Whatsapp for instance localised their entire offering without even translating its legal docs. Just to give you a high-profile example. – Simon Jun 13 '17 at 13:12

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.