Proposed Guidelines for Website Data Privacy Policies and an Application Thereof

  • Conference paper
  • First Online:
Human Aspects of Information Security and Assurance (HAISA 2023)

Abstract

Business-to-consumer (B2C) e-commerce websites have recently increased in South Africa. The extent of addressing privacy requirements in B2C e-commerce websites is still in its infancy in South Africa with the Protection of Personal Information Act which only came into effect recently. A sco** literature review was conducted to define a holistic set of privacy policy guidelines for websites. In total, 14 privacy policy guidelines for websites were identified to aid website owners in develo** their online data privacy policies. The research design further included a sample of ten popular South African B2C e-commerce website privacy policies using an embedded single-case study design to illustrate the application of the guidelines and to establish the extent of the content of the sample of website privacy policies in terms of the proposed privacy policy guidelines. The findings indicated that the website privacy policies did not fully address the proposed guidelines. The proposed privacy policy guidelines for websites provide website owners with a way to assess and improve their privacy policy content to contribute to compliance with data privacy requirements and to build consumer trust.

This is a preview of subscription content, log in via an institution to check access.

Access this chapter

Subscribe and save

Springer+ Basic
EUR 32.99 /Month
  • Get 10 units per month
  • Download Article/Chapter or Ebook
  • 1 Unit = 1 Article or 1 Chapter
  • Cancel anytime
Subscribe now

Buy Now

Chapter
EUR 29.95
Price includes VAT (Germany)
  • Available as PDF
  • Read on any device
  • Instant download
  • Own it forever
eBook
EUR 93.08
Price includes VAT (Germany)
  • Available as EPUB and PDF
  • Read on any device
  • Instant download
  • Own it forever
Hardcover Book
EUR 117.69
Price includes VAT (Germany)
  • Durable hardcover edition
  • Dispatched in 3 to 5 business days
  • Free ship** worldwide - see info

Tax calculation will be finalised at checkout

Purchases are for personal use only

Institutional subscriptions

References

  1. Revinova, S.: E-Commerce in BRICS: similarities and differences. Int. J. Econ. Policy Emerg. Econ. 12, 377–389 (2019)

    Google Scholar 

  2. Kordić, N.: The extent of e-commerce presence in develo** countries. In: Proceedings of the 1st International Scientific Conference - Sinteza 2014, pp. 313–317. Singidunum University, Belgrade, Serbia (2014). https://doi.org/10.15308/sinteza-2014-313-317

  3. Earp, J.B., Anton, A.I., Aiman-Smith, L., Stufflebeam, W.H.: Examining internet privacy policies within the context of user privacy values. IEEE Trans. Eng. Manag. 52, 227–237 (2005)

    Article  Google Scholar 

  4. Protection of Personal Information, Act 4 of 2013. https://www.gov.za/sites/default/files/gcis_document/201409/3706726-11act4of2013protectionofpersonalinforcorrect.pdf%0A. Accessed 2 May 2022

  5. Netshakhuma, N.S.: Assessment of a South Africa national consultative workshop on the Protection of Personal Information Act (POPIA). Global Knowl. Mem. Commun. 69, 58–74 (2020)

    Article  Google Scholar 

  6. Agrawal, R., Grosky, W.I., Fotouhi, F.: Ranking privacy policy. In: Proceedings of IEEE 23rd International Conference on Data Engineering Workshop, pp. 192–197. IEEE (2007).https://doi.org/10.1109/ICDEW.2007.4400991

  7. Javed, Y., Salehin, K.M., Shehab, M.: A study of South Asian websites on privacy compliance. IEEE Access 8, 156067–156083 (2020). https://doi.org/10.1109/ACCESS.2020.3019334

    Article  Google Scholar 

  8. Tjhin, I., Vos, M., Munaganuri, S.: Privacy governance online: privacy policy practices on New Zealand websites. In: Proceedings of Pacific Asia Conference on Information Systems, PACIS 2016 (2016)

    Google Scholar 

  9. Eckert, A., Milan, G.S., Roy, G., Bado, R.: Welcome back: Repurchase intention of Brazilian customers on e-commerce websites. Revista de Ciências da Administração. 23, 106–120 (2021)

    Article  Google Scholar 

  10. Meinert, D.B., Peterson, D.K., Ii, J.R.C., Crossland, M.D.: Would regulation of web site privacy policy statements increase consumer trust? Inf. Sci.: Int. J. Emerg. Transdisc. 9, 123–142 (2006). https://doi.org/10.28945/476

  11. Wu, K.-W., Huang, S.Y., Yen, D.C., Popova, I.: The effect of online privacy policy on consumer privacy concern and trust. Comput. Hum. Behav. 28, 889–897 (2012)

    Article  Google Scholar 

  12. Malapane, T.A.: A risk analysis of e-commerce: a case of South African online shop** space. In: 2019 Systems and Information Engineering Design Symposium (SIEDS), pp. 1–6. IEEE (2019)

    Google Scholar 

  13. Anic, I.-D., Škare, V., Kursan Milaković, I.: The determinants and effects of online privacy concerns in the context of e-commerce. Electron Commer. Res. Appl. 36, 100868 (2019)

    Article  Google Scholar 

  14. Staunton, C., et al.: Enabling the use of health data for research: develo** a POPIA code of conduct for research in South Africa. S. Afr. J. Bioeth. Law. 14, 33–36 (2021)

    Google Scholar 

  15. Aladeokin, A., Zavarsky, P., Memon, N.: Analysis and compliance evaluation of cookies-setting websites with privacy protection laws. In: Proceedings of Twelfth International Conference on Digital Information Management (ICDIM), pp. 121–126. IEEE (2017)

    Google Scholar 

  16. Ki Bareh, C.: Assessment of the Privacy and Security Practices of the Indian Academic Websites. Library Philosophy and Practice (2021)

    Google Scholar 

  17. Tesfay, W.B., Hofmann, P., Nakamura, T., Kiyomoto, S., Serna, J.: Privacyguide: Towards an implementation of the EU GDPR on internet privacy policy evaluation. In: IWSPA 2018 - Proceedings of the 4th ACM International Workshop on Security and Privacy Analytics, Co-located with CODASPY 2018, 15–21 Janua, 2018 (2018). https://doi.org/10.1145/3180445.3180447

  18. Steyn, L.J., Mawela, T.: A trust-based e-commerce decision-making model for South African citizens. In: Proceedings of the Annual Conference of the South African Institute of Computer Scientists and Information Technologists on - SAICSIT ’16, pp. 1–9. ACM Press, New York (2016)

    Google Scholar 

  19. Mofokeng, T.E.: An empirical study step** towards ethnographic research for e-commerce websites: a perspective of user-centred design. Afr. J. Sci. Technol. Innov. Dev. 14, 1–19 (2021). https://doi.org/10.1080/20421338.2021.1958987

    Article  Google Scholar 

  20. Hung, P.C.K., Cheng, V.S.Y.: Privacy. In: Encyclopedia of Database Systems, pp. 2136–2137. Springer, Boston (2009).https://doi.org/10.1007/978-0-387-39940-9_274

  21. Cappel, J.J., Shah, V., Verhulsdonck, G.: Perceptions of online privacy. J. Bus. Educ. Leadersh. 10, 122–133 (2020)

    Google Scholar 

  22. Lockhat, R.: Social media and the protection of personal information act. South. Afr. J. Anaesth. Analg. 27, 69–72 (2021).https://doi.org/10.36303/SAJAA.2021.27.6.S1.2702

  23. Staunton, C., Tschigg, K., Sherman, G.: Data protection, data management, and data sharing: Stakeholder perspectives on the protection of personal health information in South Africa. PLoS ONE 16, e0260341 (2021). https://doi.org/10.1371/journal.pone.0260341

    Article  Google Scholar 

  24. Jiang, Y., Syn, T.: Online privacy policy disclosure: an empirical investigation. J. Comput. Inf. Syst. 63, 663–680 (2022). https://doi.org/10.1080/08874417.2022.2095542

    Article  Google Scholar 

  25. Sindermann, C., Schmitt, H.S., Kargl, F., Herbert, C., Montag, C.: Online privacy literacy and online privacy behavior – the role of crystallized intelligence and personality. Int. J. Hum. Comput. Interact. 37, 1455–1466 (2021). https://doi.org/10.1080/10447318.2021.1894799

    Article  Google Scholar 

  26. Brunotte, W., Chazette, L., Kohler, L., Klunder, J., Schneider, K.: What about my privacy? hel** users understand online privacy policies. In: Proceedings of the International Conference on Software and System Processes and International Conference on Global Software Engineering, pp. 56–65. ACM, New York (2022). https://doi.org/10.1145/3529320.3529327

  27. Kretschmer, M., Pennekamp, J., Wehrle, K.: Cookie banners and privacy policies: measuring the impact of the GDPR on the web. ACM Trans. Web 15, 1–42 (2021)

    Article  Google Scholar 

  28. Capistrano, E.P.S., Chen, J.V.: Information privacy policies: the effects of policy characteristics and online experience. Comput. Stand Interfaces 42, 24–31 (2015)

    Article  Google Scholar 

  29. Steinfeld, N.: “I agree to the terms and conditions”: (How) do users read privacy policies online? An eye-tracking experiment. Comput. Hum. Behav. 55, 992–1000 (2016)

    Article  Google Scholar 

  30. Amos, R., Acar, G., Lucherini, E., Kshirsagar, M., Narayanan, A., Mayer, J.: Privacy policies over time: curation and analysis of a million-document dataset. In: Proceedings of the Web Conference 2021, pp. 2165–2176. ACM, New York (2021)

    Google Scholar 

  31. Reinhardt, D., Borchard, J., Hurtienne, J.: Visual interactive privacy policy: the beter choice? In: Proceedings of Conference on Human Factors in Computing Systems (2021)

    Google Scholar 

  32. Kotal, A., Joshi, K.P., Joshi, A.: ViCLOUD: measuring vagueness in cloud service privacy policies and terms of services. In: Proceedings of IEEE 13th International Conference on Cloud Computing (CLOUD), pp. 71–79. IEEE (2020). https://doi.org/10.1109/CLOUD49709.2020.00023

  33. Proctor, R.W., Ali, M.A., Vu, K.-P.L.: Examining usability of web privacy policies. Int. J. Hum. Comput. Interact. 24, 307–328 (2008). https://doi.org/10.1080/10447310801937999

    Article  Google Scholar 

  34. Micheti, A., Burkell, J., Steeves, V.: Fixing broken doors: strategies for drafting privacy policies young people can understand. Bull. Sci. Technol. Soc. 30, 130–143 (2010)

    Article  Google Scholar 

  35. Ibdah, D., Lachtar, N., Raparthi, S.M., Bacha, A.: “Why should i read the privacy policy, i just need the service”: a study on attitudes and perceptions toward privacy policies. IEEE Access 9, 166465–166487 (2021). https://doi.org/10.1109/ACCESS.2021.3130086

    Article  Google Scholar 

  36. Zaeem, R.N., Barber, K.S.: The effect of the GDPR on privacy policies: recent progress and future promise. ACM Trans. Manag. Inf. Syst. 12, 1–20 (2021). https://doi.org/10.1145/3389685

    Article  Google Scholar 

  37. Lin, X., Liu, H., Li, Z., **ong, G., Gou, G.: Privacy protection of China’s top websites: a Multi-layer privacy measurement via network behaviours and privacy policies. Comput. Secur. 114, 102606 (2022)

    Article  Google Scholar 

  38. Prinsloo, P., Kaliisa, R.: Data privacy on the African continent: opportunities, challenges and implications for learning analytics. Br. J. Edu. Technol. 53, 894–913 (2022)

    Article  Google Scholar 

  39. Botha, J., Grobler, M.M., Hahn, J., Eloff, M.: A high-level comparison between the South African protection of personal information act and international data protection laws. In: Proceedings of the 12th International Conference on Cyber Warfare and Security, ICCWS 2017, pp. 57–66 (2017)

    Google Scholar 

  40. Oki, O., Ngotshane, S.: Investigating the effects of covid-19 on online shop** cybercrime in buffalo city. In: Proceedings of 2021 International Conference on Electrical, Computer, Communications and Mechatronics Engineering (ICECCME), pp. 1–6. IEEE (2021)

    Google Scholar 

  41. Mutemwa, M., Mtsweni, J., Mkhonto, N.: Develo** a cyber threat intelligence sharing platform for South African organisations. In: Proceedings of 2017 Conference on Information Communication Technology and Society (ICTAS), pp. 1–6. IEEE (2017)

    Google Scholar 

  42. van Ooijen, I., Vrabec, H.U.: Does the GDPR enhance consumers’ control over personal data? an analysis from a behavioural perspective. J. Consum. Policy 42(1), 91–107 (2018). https://doi.org/10.1007/s10603-018-9399-7

    Article  Google Scholar 

  43. Lung, S.L., Wincentak, J., Gan, C., Kingsnorth, S., Provvidenza, C., McPherson, A.C.: A sco** review of suggested practices for healthcare providers when discussing sexuality with youth. Can. J. Hum. Sex. 31, 143–160 (2022). https://doi.org/10.3138/cjhs.2021-0058

    Article  Google Scholar 

  44. Rumrill, P.D., Fitzgerald, S.M., Merchant, W.R.: Using sco** literature reviews as a means of understanding and interpreting existing literature. Work 35, 399–404 (2010)

    Article  Google Scholar 

  45. Munn, Z., Peters, M.D., Stern, C., Tufanaru, C., McArthur, A., Aromataris, E.: Systematic review or sco** review? Guidance for authors when choosing between a systematic or sco** review approach. BMC Med. Res. Methodol. 18, 1–7 (2018)

    Article  Google Scholar 

  46. Page, M.J., Moher, D., McKenzie, J.E.: Introduction to PRISMA 2020 and implications for research synthesis methodologists. Res. Synth. Methods 13, 156–163 (2022). https://doi.org/10.1002/jrsm.1535

    Article  Google Scholar 

  47. Asif, M., Javed, Y., Hussain, M.: Automated analysis of Pakistani websites’ compliance with GDPR and Pakistan data protection act. In: Proceedings of International Conference on Frontiers of Information Technology (FIT), pp. 234–239. IEEE (2021).https://doi.org/10.1109/FIT53504.2021.00051

  48. Bufalieri, L., La Morgia, M., Mei, A., Stefa, J.: GDPR: when the right to access personal data becomes a threat. In: Proceedings of 2020 IEEE International Conference on Web Services (ICWS), pp. 75–83. IEEE (2020).https://doi.org/10.1109/ICWS49710.2020.00017

  49. Chang, Y., Wong, S.F., Libaque-Saenz, C.F., Lee, H.: The role of privacy policy on consumers’ perceived privacy. Gov. Inf. Q. 35, 445–459 (2018). https://doi.org/10.1016/j.giq.2018.04.002

    Article  Google Scholar 

  50. Coleti, T.A., Correa, P.L.P., Filgueiras, L.V.L., Morandini, M.: TR-Model. A metadata profile application for personal data transparency. IEEE Access 8, 75184–75209 (2020). https://doi.org/10.1109/ACCESS.2020.2988566

  51. Fouad, I., Santos, C., Al Kassar, F., Bielova, N., Calzavara, S.: On compliance of cookie purposes with the purpose specification principle. In: 2020 IEEE European Symposium on Security and Privacy Workshops (EuroS&PW), pp. 326–333. IEEE (2020). https://doi.org/10.1109/EuroSPW51379.2020.00051

  52. Mamakou, X.J., Kardaras, D.K., Papathanassiou, E.A.: Evaluation of websites’ compliance to legal and ethical guidelines: a fuzzy logic–based methodology. J. Inf. Sci. 44, 425–442 (2018). https://doi.org/10.1177/0165551517697610

    Article  Google Scholar 

  53. Nwaeze, A.C., Zavarsky, P., Ruhl, R.: Compliance evaluation of information privacy protection in e-government systems in Anglophone West Africa using ISO/IEC 29100:2011. In: Proceedings of Twelfth International Conference on Digital Information Management (ICDIM), pp. 98–102. IEEE (2017). https://doi.org/10.1109/ICDIM.2017.8244644

  54. Zaeem, R.N., German, R.L., Barber, K.S.: PrivacyCheck: automatic summarization of privacy policies using data mining. ACM Trans. Internet Technol. 18, 1–18 (2018). https://doi.org/10.1145/3127519

    Article  Google Scholar 

  55. Nilmanat, K., Kurniawan, T.: The quest in case study research. Pac. Rim. Int. J. Nurs. Res. Thail. 25, 1–6 (2020)

    Google Scholar 

  56. Woodside, A.G., Wilson, E.J.: Case study research methods for theory building. J. Bus. Ind. Mark. 18, 493–508 (2003). https://doi.org/10.1108/08858620310492374

    Article  Google Scholar 

  57. Yin, R.K.: Case Study Research: Design and Methods. Sage Publications, Thousand Oaks (2003)

    Google Scholar 

  58. Schoch, K., Burkholder, G., Cox, K., Crawford, L., Hitchcock, J.: Research Design and Methods : An Applied Guide for the Scholar-Practitioner. SAGE Publications Inc, Thousand Oaks (2019)

    Google Scholar 

  59. Lenz, A.S.: Using single-case research designs to demonstrate evidence for counseling practices. J. Couns. Dev. 93, 387–393 (2015). https://doi.org/10.1002/jcad.12036

    Article  Google Scholar 

  60. Taherdoost, H.: Sampling methods in research methodology; how to choose a sampling technique for research. SSRN Electron. J. 5, 18–27 (2016). https://doi.org/10.2139/ssrn.3205035

    Article  Google Scholar 

  61. Seawright, J., Gerring, J.: Case selection techniques in case study research: a menu of qualitative and quantitative option. Polit. Res. Q. 61, 294–308 (2008). https://doi.org/10.1177/1065912907313077

    Article  Google Scholar 

  62. Jensen, C., Potts, C.: Privacy policies as decision-making tools: an evaluation of online privacy notices. In: Proceedings of the 2004 conference on Human factors in computing systems - CHI 2004, pp. 471–478. ACM Press, New York (2004).https://doi.org/10.1145/985692.985752

  63. Srinath, M., Wilson, S., Giles, C.L.: Privacy at scale: introducing the PrivaSeer corpus of web privacy policies. In: Proceedings of the 59th Annual Meeting of the Association for Computational Linguistics and the 11th International Joint Conference on Natural Language Processing (Volume 1: Long Papers), pp. 6829–6839. Association for Computational Linguistics, Stroudsburg (2021).https://doi.org/10.18653/v1/2021.acl-long.532

  64. Udayanga, V., Jayarajah, U., Colonne, S.D., Seneviratne, S.A.: Quality of the patient-oriented information on thyroid cancer in the internet. Health Policy Technol. 9, 302–307 (2020). https://doi.org/10.1016/j.hlpt.2020.03.007

    Article  Google Scholar 

Download references

Author information

Authors and Affiliations

Authors

Corresponding author

Correspondence to Armand Vorster .

Editor information

Editors and Affiliations

Appendix a: Website Privacy Policy Guidelines

Appendix a: Website Privacy Policy Guidelines

Website Privacy Policy Guidelines

POPIA map**

Description

Questions

Accuracy of Data

Information Quality (Condition 5)

The information set out in the privacy policy must be up to date, and the terms discussed in the policy should be accurate and true [52]

Q1. Is the information defined in the privacy policy up to date (are there any timestamps showing when the policy was last updated)?

Assurances

Accountability (Condition 1)

Defines the third-party laws that govern how the responsible party of the website manages and processes data and ensures that the privacy policy is constructive [6, 49]

Q2. Are the third-party laws that govern how the responsible party of the website manages and processes the data made available (are any details given about POPIA or the Information Regulator of South Africa)?

Breach Notification

Security Safeguards (Condition 7)

This is the notification guarantee that the website provides to the data subject. If any form of data breach occurs, this breach must be communicated with the data subject. The breach will also be reported to the applicable authority [7, 47]

Q3. Will the data subject be notified if a breach of personal data occurs?

Q4. Does the policy contain the steps and processes that will be followed if a breach occurs?

Q5. Will the breach be reported to the appropriate authority?

Clarity of the Privacy Policy

Openness (Condition 6)

It must be easy to comprehend and not be long and tedious, which may discourage users from reading it [37, 51]

Q6. Is the policy easy to comprehend and not long and tedious?

The FRES and FGL scores can be calculated to determine if the policy is easy to comprehend. Readable.com can be used to determine the FRES score, FGL score and word count

Cross-border data transfer and Portability

Further

Processing

Limitation

(Condition 4)

The user or data subject must be aware of any personal data or information transferred outside the original borders of consent [47, 50]

Q7. Are any details given on cross-border data transfer?

Data Collection Sources and Purpose

Processing limitation (Condition 2)

Includes the sources and purpose of collecting the data [47]. Only data that is essential for processing should be collected, and the collection volume should not exceed the privacy policy definitions [37]

Q8. Are the data collection sources and purposes defined?

Q9. Is it defined that only the data that is essential for processing is collected and that the collection volume will not exceed the privacy policy definitions?

Data Processing and Consent

Processing limitation (Condition 2)

Encompasses the requirements and purpose for data processing. The data subject must provide consent for any data that will be processed, and the type of data to be processed should be made clear in the privacy policy [47, 53]

Q10. Is consent obtained from the data subject before any data is processed?

Q11. Is the type of data that will be processed made clear in the privacy policy?

Data Retention

Purpose Specification (Condition 3)

Defines the data retention period of the processing body. The privacy policy should also provide details on when the data subject’s personal data will be deleted or removed [37]

Q12. Is the data retention period by the processing body provided?

Q13. Are details provided on when the data subject’s data will be deleted or removed?

Data Security Measures

Security Safeguards (Condition 7)

The personal information and data of the user must be protected and secured by the data operator. Personal data must also be guarded and protected when transferred [52]. The data operator should provide assurances and steps taken to protect the integrity of the data [49]

Q14. Information and data of the user must be protected and secured by the data operator, are security measures in place to protect the data?

Q15. Personal data must also be guarded and protected when transferred. The data operator should provide assurances and steps taken to protect the integrity of the data. Are these steps defined?

Disclosure of Privacy Policy

Openness (Condition 6)

It is vital for the privacy policy to be visible and openly available on the website accessed, informing the user of their rights [48]

Q16. Is the privacy policy openly available on the website?

Entity

Openness (Condition 6)

Provides information on the website, data operator and processor. In addition, the website should provide contact details on how the data subject can contact them [6]

Q17. Information about the website, data operator and processor must be provided in the privacy policy, is this information available?

Q18. Does the website provide contact details for the data subject on how to contact them?

Transparency and Ease of Access

Openness (Condition 6)

The privacy policy should be uncomplicated to find on the website, and access to the privacy policy should not be complicated or misleading [37]

Q19 Is the privacy policy easily found on the website (access to the privacy policy should not be complicated or misleading)?

This can be calculated by counting the number of clicks it takes to reach the website privacy policy

Third-Party Data Users and Disclosure of Personal Data

Further Processing Limitation (Condition 4)

If data is being shared or distributed with a third-party company, the data subject should be alerted, and consent should be obtained [47]. The roles of each third-party data user must be clearly defined [50]

Q20. If data is being shared or distributed with a third-party company, the data subject should be alerted, and consent should be obtained, is this consent mentioned or discussed in the privacy policy?

Q21. Are the roles of each third-party data user clearly defined?

User Control

Data subject participation (Condition 8)

The data subject must be able to control who accesses their data [49]. Additionally, it must be possible for data subjects to ask for their data to be deleted. Finally, the sharing and processing of their data should be controllable [7]

Q22. Can the data subject control who accesses their data?

Q23. Is it possible for the data subject to ask for their data to be deleted?

Rights and permissions

Reprints and permissions

Copyright information

© 2023 IFIP International Federation for Information Processing

About this paper

Check for updates. Verify currency and authenticity via CrossMark

Cite this paper

Vorster, A., da Veiga, A. (2023). Proposed Guidelines for Website Data Privacy Policies and an Application Thereof. In: Furnell, S., Clarke, N. (eds) Human Aspects of Information Security and Assurance. HAISA 2023. IFIP Advances in Information and Communication Technology, vol 674. Springer, Cham. https://doi.org/10.1007/978-3-031-38530-8_16

Download citation

  • DOI: https://doi.org/10.1007/978-3-031-38530-8_16

  • Published:

  • Publisher Name: Springer, Cham

  • Print ISBN: 978-3-031-38529-2

  • Online ISBN: 978-3-031-38530-8

  • eBook Packages: Computer ScienceComputer Science (R0)

Publish with us

Policies and ethics

Navigation