Sam Mankiewicz, Kiva's Chief Technical Officer, said at the end of May,
here in Ingvar's
Risk and Due Diligence threadI'm taking to heart the suggestions for more explicit statements on the website about security, and hope to get something together in the next month or so
While Sam is still dealing with that, I wondered what form such statements might take, and where on the Kiva site they should be. Having looked at what other companies doing business on the internet say about security, and where on their sites they say it, it seems fairly obvious that the place for such statements would be
Kiva's Privacy Policy, which although a free-standing document, is linked to
Kiva's Terms of Use and incorporated within it - see the end of the first paragraph of the ToU where there's an injunction to read the Privacy Policy as well as the rest of the ToU.
This is what Kiva's Privacy Policy consists of right now:
1. Kiva will not rent or sell your personal information to third parties.
2. By default, you will receive update emails on your loans that are sent by our field partners through the Website. Kiva will not disclose your email address to our partners in any case -- these emails are sent through a webform without any third party learning your address. You can choose not to receive these emails through a preference on the Website.
3. By default, you may receive periodic newsletter emails from Kiva. The frequency of these newsletters may vary but will be no greater than once per month. You can choose not to receive these newsletters through a preference on the Website.
4. Kiva will not disclose your personally identifiable lending activity to any third party without consent. Kiva reserves the right to record and display anonymous lending activity on the Website and display the general regions where our lenders are located.
5. We take privacy seriously and we value yours.
Finding explicit statements and reassurances about security invariably involves looking at a company's Privacy Policy. I looked at the policies of a few companies who can reasonably be assumed to be doing it more or less right:
Google,
Amazon,
eBay,
Microsoft,
IBM,
Wal-Mart, and
Yahoo.
Having read through those privacy policies (it's OK, I don't easily get bored..) I think it's fair to say that Kiva's current Privacy Policy doesn't really stack up in terms of what a privacy policy normally does. In fact it's pretty puny. This isn't a criticism of Kiva -- I recognize that it's probably a long way down the list of priorities -- but by looking at what the big guys do, they could see what the privacy policy framework tends to be, and re-write theirs accordingly, on the monkey-see monkey-do principle. Or, to dignify it a little, indulge in a little judicious emulation...
The privacy policies of Google, IBM etc, tend to follow a basic pattern, some more systematically than others, but in essence they all state in relation to users' personal data:
- what is collected
- how it is collected (web forms, cookies, web beacons etc)
- how it is used
- whether and to what extent it is shared with third parties
- what security measures are in place to protect against unauthorized access
Some of the privacy policies I've looked at go slightly further than the framework outlined above, and comply with
California Business & Professions Code 22575 et seq by being dated, and by providing links to archived copies of previous versions of the privacy policy. Some of the companies doing business in the more heavily regulated environment of Europe (notably, Google and Amazon) are members of the U.S. Department of Commerce's
Safe Harbor program and adhere to that program's privacy principles of "Notice, Choice, Onward Transfer, Security, Data Integrity, Access and Enforcement". Again, many of those companies are signed up to the
TRUSTe Web Privacy Seal program, which provides independent verification of statements companies make on their websites about privacy and security of personal data.
Although membership of TRUSTe and/or Safe Harbor might be a little advanced for Kiva at this stage (of the two, TRUSTe certification would be easier to achieve), I suggest that Kiva's privacy policy could use that kind of systematic approach evident in the privacy policies of the big players, and it would certainly I think be the right place for Sam to make those statements he's still mulling over about security.
Peter
