Vic government's mobile app privacy policies need improving: report

Acting Victorian Privacy Commissioner David Watts. Photo credit: Privacy Victoria.

A privacy sweep of 64 Victorian government mobile apps in May 2014 found that very few had app-specific privacy policies, according to a report released today.

Acting Victorian Privacy Commissioner David Watts found there was either no mobile app privacy policy or just a reference to a "generic website privacy policy".

"There were many examples of an app developer being named as the app seller or data controller rather than the responsible [developer] company," he said in a statement.

Watts also found that in-app communications were "sometimes not tailored" for the screen size of the smartphones they were meant to be used on.

The privacy sweep found that the Apple iOS and Android operating systems dominated.

"Whereas 94 per cent of the [64] swept apps had an iOS version, only 62 per cent catered for Android.This reduces the extent of [Victorian] citizen engagement," said Watts.

However, he also found that Victorian government agencies were engaging in good privacy practices.

For example, users are required to accept a privacy statement if they wish to use the app they have downloaded.

"Apps aimed at school children require their parents or guardian to complete a consent form before a child register to use the app," said Watts.

Crime reporting apps, such as the Victorian Police app, give users a 'report anonymously' option.

In addition, some apps included multiple contact details such as a phone number and email address.

Check the privacy of mobile apps: NSW privacy commissioner

The sweep was conducted as part of the Global Privacy Enforcement Network (GPEN) Privacy Sweep of mobile apps.

A Privacy Victoria spokesman said that it will be producing mobile app guidance for state government agencies by December 2014.

Privacy Victoria implemented Privacy by Design, a set of policies that integrates with technology, on 1 July.

Watts said that Privacy by Design is about “embedding privacy into IT, business practices and networked infrastructures right from the outset".

Follow Hamish Barwick on Twitter: @HamishBarwick