1

Some websites intentionally hide access to privacy policies and terms & conditions they require users to agree to.

For example, consider the Hotel De Anza. If you click through the steps of the reservation process, the final page has a section titled "Privacy & Promotional Offers" which says "The privacy of our guests is very important to us. Please view our Privacy Policy." It then requires the would-be guest to check a box saying "Please acknowledge that you have read and accept our privacy policy."

However, the words "Privacy Policy" are not links, and there are no other links available which allow the user to actually see the privacy policy.

Searching for "privacy policy" on the domain where the user must agree produces many results for "Search Criteria View" at different hotels. Of the top five results, three had no privacy policy linked to from the page that turned up in search results, and two (Bedford Village Inn and The Heathman Hotel of Kirkland, Washington) had footer links to different privacy policies. I don't think either apply to the Hotel De Anza.

This privacy policy, which the user must indicate they agree to, could say things like "We may sell your detailed personal information to whatever spammer we like for marketing purposes and not require them to keep it safe." With the prices some of those hotels charge, their guest lists could fetch a good price as a list of potentially lucrative scam targets.

Additionally, secrecy laws protecting private companies would in most cases prevent any individual scam target from finding out how they got on the list. Companies are apparently not required to accurately disclose how they got any individual's information, which is often through a many-layered chain of data brokers to help make sure no individual company can be held accountable for any violations.

The words about the importance of privacy and reviewing the privacy policy seem more than a bit disingenuous when the site hides any links to the policy. The same goes for Terms and Conditions which other sites require similar explicit acceptance of, while hiding links to the actual policy.

Are there any negative consequences to a business which acts in this way, or are all the negative consequences on their [prospective or actual] customers?

Improve this question
3
  • Hanlon's razor?
    – brhans
    Aug 19, 2019 at 21:07
  • @brhans In at least some cases, I've seen sites go out of their way to remove the terms link from the page where people must agree to it, even though it might be in a footer elsewhere on the site, or change the color of that specific link to match the page background and make it harder to find. Some cases covered by this question may be incompetence, but certainly not all.
    – WBT
    Aug 19, 2019 at 21:11
  • The GDPR states the direct opposite of what you claim. Article 14.2.f, enumerated right of the data subject: be told where the information originated. Applies to all companies that hold such data on EU subjects. This overrides secrecy laws.
    – MSalters
    Aug 20, 2019 at 21:39

1 Answer 1

Reset to default
1

The effect of not making Terms and Conditions available is generally that the consumer can void them. That is to say, usually they're voidable, not void from the start.

Lacking these terms, companies would have to act under default privacy rules which are generally strict. Under the GDPR, it's even further restricted. Consent requires informed consent, so no T&C means no information and no consent. Furthermore, often these T&C also serve to provide GDPR-mandated information about the identities of2 data processing parties, in which case not provinding that is a second violation.

As usual, this applies to companies worldwide that offer to trade with EU citizens.

Improve this answer
2
  • Responding to comment on question which might be integrated into this Answer, if I am an EU subject receiving a telemarketing call and ask "where did you get my number?" and the caller refuses to answer or just says "we bought it on some list" without specifying, what recourse would be available?
    – WBT
    Aug 21, 2019 at 13:49
  • 1
    @wbt: contact your national organization responsible for GDPR enforcement.
    – MSalters
    Aug 21, 2019 at 15:55

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .