ITをめぐる法律問題について考える

弁護士水町雅子のIT情報法ブログ

GDPRプライバシーポリシー(プロファイリング・マーケティング関連記載例)

GDPR対応のプライバシーポリシー(Privacy Notice, Privacy Statement, Privacy Policy等名称は不統一)のうち、プロファイリングの関連記載があるもので、目についたものをブログに書いておきたいと思います。

☆ホンダ https://www.honda.co.uk/general-information/privacy-policy.html

 (b)   Your Rights and Choices regarding Direct Marketing

Honda will give you the opportunity to opt-in (consent) to having your contact details used for direct marketing purposes at the time we ask you to submit your details.

If you do not want us to send you direct marketing, or to use your personal data for profiling related to direct marketing, or to pass your details on to third parties for marketing purposes, you can ask us not to do this, at any time, by:

  • Replying to a direct marketing email, by selecting the ‘unsubscribe’ button;
  • By changing privacy settings in an app (if applicable to the app);
  • By contacting us at consentUK@honda-eu.com or writing to:
    The Database Manager, Honda (UK), Cain Road, Bracknell, RG12 1HL, United Kingdom; or
  • By calling us on 0345 200 8000.

 

 

☆LLOYDS すごく長々と説明している https://www.lloydsbank.com/help-guidance/customer-support/privacy-explained/data-privacy-notice.asp#8

14. How we work out what marketing you receive
We use marketing to let you know about products, services and offers that you may want from us. This section tells you how we decide what marketing to show or send you. It also explains how we work out what you may be interested in.

We may use your personal information to make decisions about what products, services and offers we think you may be interested in. This is what we mean when we talk about ‘marketing’.

We can only use your personal information to send you marketing messages if we have either your consent or a ‘legitimate interest’. That is when we have a business or commercial reason to use your information. It must not conflict unfairly with your own interests.

The personal information we have for you is made up of what you tell us, and data we collect when you use our services, or from outside organisations we work with. We study this to form a view on what we think you may want or need, or what may be of interest to you. This is how we decide which products, services and offers may be relevant for you.

This is called profiling for marketing purposes. You can contact us at any time and ask us to stop using your personal information this way.

If you allow it, we may show or send you marketing material online (on our own and other websites including social media), in our own and other apps, or by email, mobile phone, or post or through smart devices and other digital channels.

What you get will depend on marketing choices that you set. You can change these at any time and tell us to stop sending you marketing.

You can also tell us not to collect data while you are using our websites or mobile apps. If you do, you will still see some marketing but it will not be tailored to you. See our Cookies Policy for details about how we use this data to improve our websites and mobile apps.

Whatever you choose, you'll still receive statements and other important information such as changes to your existing products and services.

We do not sell the personal information we have about you to outside organisations.

We may ask you to confirm or update your choices, if you take out any new products or services with us in future. We will also ask you to do this if there are changes in the law, regulation, or the structure of our business.

If you change your mind you can contact us to update your choices at any time.

Back to top

15. How we use your information to make automated decisions
Here we tell you how we use automated systems to make decisions about you and your money. We also explain the rights you have to challenge decisions made this way.

We sometimes use systems to make automated decisions about you or your business. This helps us to make sure our decisions are quick, fair, efficient and correct, based on what we know. Automated decisions can affect the products, services or features we may offer you now or in the future, or the price that we charge you for them. They are based on personal information that we have or that we are allowed to collect from others.

Here are the types of automated decision we make:

Pricing
We may decide what to charge for some products and services based on what we know. For instance, if you use our online mortgage calculator, it will use the personal financial details you put in to estimate the kind of mortgage we may offer you. If you apply for insurance, we will compare what you tell us with other records to work out how likely you are to make a claim. This will help us decide whether to offer you the product and what price to charge you.

Tailoring products, services, offers and marketing
We may place you in groups with similar customers. These are called customer segments. We use these to study and learn about our customers’ needs, and to make decisions based on what we learn. This helps us to design products, services and offers for different customer segments, and to manage our relationships with them. It also helps us tailor the marketing that individuals receive or are shown on our own and other websites and mobile apps, including social media.

Detecting fraud
We use your personal information to help decide if your personal or business accounts may be being used for fraud or money-laundering. We may detect that an account is being used in ways that fraudsters work. Or we may notice that an account is being used in a way that is unusual for you or your business. If we think there is a risk of fraud, we may stop activity on the accounts or refuse access to them.

Opening accounts
When you open an account with us, we check that the product or service is relevant for you, based on what we know. We also check that you or your business meet the conditions needed to open the account. This may include checking age, residency, nationality or financial position. It may mean we cannot offer you the account you want.

Approving credit
We use a system to decide whether to lend money to you or your business, when you apply for credit such as a loan or credit card. This is called credit scoring. It uses past data to assess how you’re likely to act while paying back any money you borrow. This includes data about similar accounts you may have had before.

Credit scoring uses data from three sources:

Your application form
Credit reference agencies
Data we may already hold.
It gives an overall assessment based on this. Banks and other lenders use this to help us make responsible lending decisions that are fair and informed.

Credit scoring methods are tested regularly to make sure they are fair and unbiased.

This credit score can determine whether we will give you credit, or allow you to take another product or service.

Your rights

You can object to an automated decision we have made, and ask that a person reviews it.

If you want to know more about these rights, please contact us.

Back to top 

 ☆MERKLE Profilingの節を立てて説明。ちょっと書き方のトーンが一般と違うような気もする https://www.merkleinc.com/emea/getting-know-your-privacy-rights/privacy-notice#profiling

 3.1 Profiling

Some of what we do with your information involves what's known as "profiling" – automatically using personal information to work out certain things about people, like analysing or predicting their personal preferences, interests, or behaviour. This may include models predicting your likely spend on various products and services e.g. monthly spend on vehicle fuel.

Automatically working out whether you fit in a certain category, e.g. "men living in a particular postcode area aged between 20 and 30", is treated as profiling, even though it's based on facts about you. Similarly, when we try to predict your buying habits, how likely you are to respond to marketing or advertising and which products or brands you like the most, this counts as profiling. We take steps to ensure that our profiling process is accurate.

We also process other types of data, not classified as personal data, which we may link to your personal data for the purposes of profiling. This may include business data for the purposes of identifying segments of individuals who live near certain businesses, or aggregated credit card spend data for the purpose of modelling likely behaviour.

We do not make automatic decisions about you based on profiling, except to find out which group of people fall within our clients' campaign criteria (e.g. "People who like cats," or "People who seem like these particular customers of the client"). This lets our client target its advertising or marketing to a large group of people more quickly and efficiently. The only result of this automated decision is that, if you are in the selected group, you may receive targeted advertising or marketing from our client (which may be personalised to you), or your information may be passed on to our client for their advertising or marketing. Generally, people who get advertising or marketing messages would not be significantly affected by it, because they are free to choose whether or not to buy the advertised or marketed product/service.

You can object to and opt out of our profiling (see Your Rights).

 

☆ONCARE https://www.oncare.me/company/privacy.html

Marketing purposes (Article 6 (1) lit f GDPR)
ONCARE is keen to nurture the customer relationship with you and to send you information and offers about our product / services. We therefore process your data to send you the relevant information and offers via email.

You may object to the use of your personal data for the purpose of direct marketing at any time; this also applies to profiling insofar as it is associated with direct marketing. If you object, we will cease processing your personal information for this purpose.

You can withdraw your consent at any time free of charge and informally without stating the reasons for such and should be sent via email to marketing@oncare.me or via surface mail to ONCARE GmbH, St.-Martin-Str. 114, 81669 Munich, Germany.


Automated decisions in individual cases
We do not use purely automated processing to make decisions.

 

☆TransUnion 単なる短い説明にとどまる? https://www.transunion.co.uk/legal-information/business-contacts-privacy-notice

8. WHETHER THE PERSONAL DATA IS USED TO MAKE AUTOMATED DECISIONS ABOUT YOU OR TO PROFILE YOU

We use certain profiling techniques in order to help us to understand our clients and potential clients. This in turn helps us to understand which people might be interested in which of our products and services.

We do not use automated decision-making or profiling to make any decisions that will significantly affect you. For example, we do not use it to set the prices that we charge for our products and services.

 

Audi この該当箇所自体は単なる法の説明にとどまる気がするが、Privacy Policy自体は非常に詳細で長い https://www.audiondemand.com/audi-mobility/audi-on-demand/com_en/nav/privacy-policy.html

2. Right to object to direct marketing
If the personal data concerning you are processed for direct marketing purposes, you have the right to object to the processing of personal data that concern you for the purposes of such marketing; this applies equally to profiling provided that it is tied to such direct marketing.

Information as to whether and to which extent personal data are processed for purposes relating to direct marketing is defined in the information regarding the purposes of processing, Section C of this privacy notice.

If you object to the processing for purposes relating to direct marketing, we will no longer process personal data concerning you for these purposes.

To view the full scope of your right to object, please refer to Article 21 of the General Data Protection Regulation which can be prompted with this link.

 

☆VTT Marketing 法の記述にとどまる?https://www.vttresearch.com/media/newsletter1/marketing-data-protection-policy

8. The existence of automated decision-making, including profiling
The personal data is processed for profiling of the data subject for purposes of targeting marketing, communication and sales activities to the data subject in accordance with the data subject’s areas of interest and preferences, especially for direct marketing purposes. No automated decision-making or profiling which produces legal effects or has similar material effects concerning the data subject is made. See also Cookie policy for further information.

 

☆Tactic ID 法の記述にとどまる? http://www.tacticid.com/privacy-notice/

 The right to object
You have the right to object to us processing your personal data for the following reasons:
Processing was based on legitimate interests or the performance of a task in the public interest/exercise of official authority (including profiling);
Direct marketing (including profiling); and
Processing for purposes of scientific/historical research and statistics.
Rights in relation to automated decision-making and profiling.
Automated individual decision-making and profiling
You will have the right not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning you or similarly significantly affects you.

 ☆Trivago 法の説明にとどまる? https://www.trivago.ie/privacy-policy

 3.2 Rights to object to processing of data based on legitimate interests

Article 21(1) EU General Data Protection Regulation (EU) 2016/679 (“GDPR”) gives you the right to object at any time for reasons arising out of your particular situation against the processing of personal data relating to you when your data is processed under Article 6(1)(e) or Article 6 (1)(f) GDPR. This also applies to profiling. If you object, we will no longer process your personal data unless we can establish compelling and legitimate grounds for processing that outweigh your interests, rights and freedoms, or if the processing aids the enforcing, exercising or defending of legal claims.

 ☆AirBus 一般的な説明にとどまる? https://www.airbus.com/privacy-policy.html

Will profiling take place?

As a matter of principle, your Personal Data will not be processed automatically with the objective of evaluating certain personal aspects (profiling). In the event that we should process your Personal Data with the objective of conducting profiling, we will, if prescribed by law, specifically inform you of this and of your rights in this respect. 

 ☆CommerceTools ものすごく短い? https://commercetools.com/privacy

5. Scoring

Your personal data shall not be processed to execute automated case-to-case decisions, including profiling pursuant to Art. 22 (1) and (4) GDPR.

6. Automatic decision-making, including profiling
commercetools does not carry out any form of profiling.  

 

GDPR Privacy Policy全般へのリンクはコチラ(但し、内容はないです)

 https://cyberlawissues.hatenablog.com/entry/2018/11/30/160411