Take the 2-minute tour ×
Webmasters Stack Exchange is a question and answer site for pro webmasters. It's 100% free, no registration required.

i'm really in trouble with the Privacy Policy of my site, cause i'm wondering, if my site is written ONLY in english language, then is located on a french server, then is owned by italians people, what the language of the privacy policy must be and which the laws to follow (i guess italian privacy policy law)?

I think i need to put in the italian privacy policy law in italian language, or should i translate that from italian to english or put that with both the translations (italian/english)?

The site can be accessed from wherever in the world you are, so potential visitors will be from allaround the world.

thank you.

share|improve this question
add comment

2 Answers 2

up vote 2 down vote accepted

If your site is handling personal data, it must (i.e. its practices for handling personal data must) comply with EU data protection laws (see the EU Data Protection Directive 95/46/EC for the definition of personal data). However, there is nowhere in the European Union a requirement for a website to have its privacy policy posted - except for "cookies". The directive 2009/136/EC (aka "The Cookie Law") state it is neccessary to obtain "informed consent" from the users if you intend to use cookies to track information on your website.

And there is no explicit language requirement in The Cookie Law, but the word "informed" implies that your users must be able to understand your policy. This means that the posted policy must be in a language your users should be able to understand.

Since your site is entirely in English, I believe that your users can be assumed to understand English. I.e. having the cookie policy and opt-in instructions in English is the logical choice, and in compliance with the legal requirement of your users being "informed".

Looking beyond cookies, there is (currently) no legal requirement to have a public privacy policy posted - but doing so is certainly a good idea. I would say that having it in the language of the website is the logical choice that best fulfills the objective of making your users informed about how your site treats personal data. The word "informed" is very important in EU data protection laws - and will be even more so when the projected changes to Data Protection regulation that is currently winding its way through the EU legislative process, where the major shifts seems to be from regulation towards informed consent.

Edit: For avoidance of misunderstanding: There is no formal requirement in the current Italian Privacy Law (i.e. D.Lgs. 196/2003) to have a public privacy policy posted on an Italian website. The Italian privacy law only say the same thing as all other legislation in compliance with Directive 95/46/EC: The data subject whose data is processed has the right to be told what the data controller do with his/her personal data. No current EU law, including the Italian, go into a details about how the data controller shall fulfill this obligation. In other words, if the data controller responds to email that requests this information in a timely manner, the obligation is met.

However, having a well-written public Privacy Policy page on the site may be a better and more economical way of fulfilling this oblication than having to deal with a lot of individual requests for this information.

share|improve this answer
    
this is really a good point, thanks, so, in italy there is a specific privacy policy law used from all italy owned web sites, i assume now, that translating that law into english language, should be my solution, what you think about it? –  HugeNut Jan 6 '13 at 15:19
    
I am not sure I understand the last question, but if you're saying that you've a seen a "standard" Privacy Policy shared by a lot of Italian sites, and wonder if you should translate that into English, I don't think that is a good idea. Your website's Privacy Policy page should be an accurate and complete description of your site's specific privacy policy - not some sort of generic document. If a lot of different Italian sites uses exactly the same language, they may have copied it from each other, and this may neither be accurate nor complete. –  Free Radical Jan 6 '13 at 15:56
    
ok understood, so anyway, assumed my policy privacy text is ok, can i post it exclusively in english language? as for the site language i mean .. or i need (cause it's italian owned) to use the italian language? –  HugeNut Jan 6 '13 at 16:28
1  
If you are creating a site for English-speaking users, then the Privacy Policy should be in English. Your users are what matters. Ownership or physical location has nothing to do with how you make sure your users are informed. –  Free Radical Jan 6 '13 at 16:31
    
so many thanks Gisle –  HugeNut Jan 6 '13 at 17:00
add comment

"Does my website have to publish a privacy policy?"
What Gisle Hannemyr's comment states might be misleading. Technically speaking you need to inform your users, but the standard way to do so is by having a privacy policy posted on your website. As further addition, consider that the California Online Privacy Protection Act (in practice reflecting on any website localized in English), clearly states:

An operator of a commercial Web site or online service that collects personally identifiable information through the Internet about individual consumers residing in California who use or visit its commercial Web site or online service shall conspicuously post its privacy policy on its Web site

So, the practical answer is: any website collecting personal data (including Cookies) should provide a privacy policy.

"How does data location impact the privacy policy?"
If European Union laws are your your law of reference, you have to inform your users in case any data is transferred outside the European Union. It's also a good practice to inform users about where the personal data is stored, particularly in case there's a third-party provider (e.g. Google with Google Analytics) involved.

"Which language should I localize the privacy policy into?"
Translate the policy into the languages used by your websites. In case your website is in English and Italian, translate into both. As Gisle Hannemyr writes, the goal is to inform the user, and the user must be informad in a language that he's capable of understanding.

"What's my law of reference?"
The law of reference is defined by the Country in which you base your operations. If the data collector is, therefore, based in Italy, you have to refer to Italian Privacy laws (D.Lgs. 196/2003). Cross country privacy enforcement is a sort of grey area, and US based large companies often don't comply with this general rule, but this is my practical suggestion:
EU laws (and Italian laws, that come from them) are very strict and already require to inform users in a deeper and more comprehensive way than other Countries' laws. Be sure to comply with your law of reference and, in case it's EU, also keep an eye to the California OPPA which adds a few more - very simple - requirements.

Also note that I'm the founder of a service that lets you generate a privacy policy that reflects all these requirements, and is of course customizable (no copy and paste of repetitive and not compliant text). The service is backed by lawyers and localized in English and Italian. Feel free to give it a try on www.iubenda.com :)

share|improve this answer
    
thanks so much andrea, ho già provato iubenda, è un ottimo servizio, purtroppo devo inserire più di 4 servizi utilizzati dalla mia app sulla privacy policy e quindi non rientro nel servizio free di iubenda. (for english people: i just sad that iubenda it is a really good service) –  HugeNut Jan 7 '13 at 10:45
    
... and if in future i'll need a professional policy privacy, i will be glad to pay iubenda than a lawer for that, sure! –  HugeNut Jan 7 '13 at 10:55
    
Thanks man, you're welcome :) –  Andrea Giannangelo Jan 7 '13 at 10:57
    
@Andrea Giannangelo, i think it sad that your website use untrue scare tactics ("No privacy policy means you risk terrible fines") to solicit business. I also think your self-promotion is misplaced, see: webmasters.stackexchange.com/faq#promotion California law does not apply in the EU. I know this subject well, serving on the Government's Privacy Commision and having just returning from a three day conference on changes in EU privacy legislation in Brussels. (I haven't bothered spending USD 27 for your product, but the iubenda website does not inspire confidence). –  Free Radical Jan 7 '13 at 12:37
    
@Gisle Hannemyr On self promotion: it's ok to disclose affiliation with a product on the StackExchange network, as far as the answer is relevant. On California laws, I didn't write that they apply in EU (which is matter of discussion), but it's a good practice to comply with the OPPA, since it meets most of the EU requirements. On fines, the statement is true, many of our customers started using our service after a fine. As of our service, you can try it for free and I'd be glad to hear your feedback about it. I'm not a lawyer, but part of the team has a strong legal background :) –  Andrea Giannangelo Jan 7 '13 at 15:20
show 4 more comments

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.