P5. Purpose for collecting and sharing user information

1. For each type of user information the company collects, does the company clearly disclose its purpose for collection?
2. Does the company clearly disclose whether it combines user information from various company services and if so, why?
3. For each type of user information the company shares, does the company clearly disclose its purpose for sharing?
4. Does the company clearly disclose that it limits its use of user information to the purpose for which it was collected?

We expect companies to clearly disclose the purpose for collecting and sharing user information for each type of user information it collects and shares. In addition, many companies own or operate a variety of products and services, and we expect companies to clearly disclose how user information can be shared or combined across services. Finally, companies should publicly commit to the principle of use limitation, which is part of the OECD privacy guidelines, among other frameworks.

Potential Sources:

• Company privacy policy
• Company webpage or section on data protection or data collection