Privacy finding
A form asks for sensitive data that the privacy policy was read as not covering
Privacy Warning Severity: High
Part of the audit Forms collect or send what the policy does not mention. Finding id: privacy.sensitiveFieldVsPolicy.
What it costs you
If the reading is right, visitors hand over their most sensitive data and the policy does not tell them what happens with it.
What to do
Give the form and the policy to the person responsible for data protection.
What it checks
- Sensitive field not covered by policy
How to fix it
Cover the data in the policy or drop the field
- Ask whoever uses the form's data whether the field is needed.
- If it is: describe in the policy why this data is collected, on what ground and how long it is kept.
- If it is not: remove the field.
- If the policy does cover it, dismiss the finding.
How to check: A person has read the policy next to the form.
A real case
GoodRx promised its users it would never share their health information, then shared it with Facebook, Google and other companies. The US Federal Trade Commission imposed a 1.5 million dollar civil penalty in February 2023.
How to verify by hand
The data protection officer.
What this relies on
The policy states the intent; the form was added or extended without review.