Behind-the-Scenes Checks Key for Opt-Out Compliance: Kelley Drye
Checking data flows and technologies on the back end to make certain that consumer opt-out requests are honored is a crucial step in compliance, Kelley Drye privacy lawyers said Thursday during the firm's webinar on opt-out compliance.
Sign up for a free preview to unlock the rest of this article
Privacy Daily provides accurate coverage of newsworthy developments in data protection legislation, regulation, litigation, and enforcement for privacy professionals responsible for ensuring effective organizational data privacy compliance.
“The right to opt out is really the right of the consumer to say, ‘Stop selling or sharing my information, stop targeted advertising,’” said Kelley Drye's Celine Guillou. “Once the user opts out, the business is really prohibited from” selling or sharing the data, and they “must also make sure that other ... recipients of that data,” like third parties, “are complying with this request from the consumer to opt out."
“Given the complex ecosystem, clawing back [data collection] really requires a concentrated, concerted and comprehensive effort on the part of the business to make sure that everything is covered,” she added.
Alex Schneider, another lawyer at the firm, said opt-outs don’t require business verification the way some other privacy rights do, such as the right to delete information. “The idea here is that with opt-out requests, it's supposed to be ... easier for the consumer to submit that request and putting [a] verification step in would ultimately be ... a roadblock, and that's how it's been viewed,” he said.
Additionally, it's prudent to avoid making opt-out banners or mechanisms too overwhelming for the user; consumers shouldn't be inundated with text or choices, the lawyers said. “A clean and concise user interface is a way to potentially ask many of the same questions, get a lot of the same information, but avoid dissuading consumers from exercising their opt-out, just by the overwhelming nature of the request form,” Schneider said. “There's also this concern that you're subverting consumer choices, not allowing the consumer to fully exercise their choice by making it ... overly complicated to submit those requests.”
Kelley Drye's Alysa Hutnik said “no law requires that you have a banner,” so if you’re going to have one, make it clear not confusing. “Most of the banners … are being used as really offense on the wiretap" front or as “extra transparency,” she said. Companies need to be able to take the language and the choices and what's happening and “sync all of that together.”
Schneider added that it's necessary to ensure that the web forms consumers use to opt out are actually linked to the correct technologies that do the data collection.
“Comprehensive is a word that's thrown around a lot in privacy, but I think it's really a word that's important,” said Guillou. “When things are done on a piecemeal basis, or without really connecting those dots … it becomes a little bit tricky.”