GDPR, which comes into force in Europe in May and calls for fines as high as 4 percent of a company’s global revenue for violations, will make it tougher to get away with book-length user agreements, says Eduardo Ustaran, co-director of the cybersecurity practice at law firm Hogan Lovells. He suggests that companies streamline their rules and make sure they’re written in plain English. If a typical user wouldn’t understand the documents, the consent that companies rely on for their business activities would be legally invalid. “Your whole basis for using people’s personal data would disappear,” Ustaran says.
Martin Garner, an analyst at technology consultancy CCS Insight, suggests companies walk readers through their policies step by step. That way they could opt out of selected provisions—limiting, for instance, third parties that can gain access to the data or restricting the kinds of information companies may stockpile. Much of what’s in the terms and conditions might be affected by the settings a user chooses, and including that information in the initial agreement unnecessarily complicates the document.
See the full story here: https://www.bloomberg.com/news/articles/2018-04-20/uber-paypal-face-reckoning-over-opaque-terms-and-conditions