“Privacy policies are like the small print in software licenses,” says Bernhard Ganglmair from the EPoS Economic Research Center. “Very few people read them. Nevertheless, German companies have been increasingly complying with their disclosure obligations since the GDPR came into force in 2018. However, many companies are still speaking gibberish from the users’ perspective, especially smaller companies. This is what our study shows. We have analyzed around 585,000 privacy policies published by 75,000 German companies between 2014 and 2021.”
The researchers find that companies neglect the requirement of giving information in “easily accessible form” if they assume that the authority responsible is paying little attention to them. Background: in Germany, GDPR compliance is monitored by different data protection authorities in the 16 federal states. How active these authorities are, depends on their budgets which vary from state to state.
Companies want to stay “below the radar”
“Apparently, companies in federal states where authorities have smaller budgets are hoping that data protection officers are less attentive and that their privacy policies will remain ‘below the radar’,” says Ganglmair. “Conversely, if companies assume increased activity, compliance with readability improves.” Since 2018, all companies are obliged to inform the individual users “in a concise, transparent, intelligible and easily accessible form, using clear and plain language” when personal data is collected.
Readability difficult to enforce
“An obligation to transparency defined in this way is subjective and therefore difficult to verify,” says Ganglmair. According to the researcher, this is not only a problem with the enforcement of the GDPR, but also with other EU legislation that uses similar wording. For example, the Platform-to-Business Regulation or the Digital Services Act could fail to have the desired effect in this aspect for the same reason.
Six years of GDPR – conclusion
The record after six years of GDPR is therefore mixed: the researcher notes that the regulation has indeed led to more transparency in the collection, processing, and use of personal data in Germany. However, communication with the users has only partially improved.