Exam CIPP-US topic 1 question 93 discussion

If a privacy policy is revised, the organization should announce the change first to employees, then to both current and former customers through its privacy notice. Both in a 2012 report and in a 2015 update, the FTC stated that companies should obtain “express affirmative consent (opt-in) before making “material” retroactive changes to privacy representations.” The FTC stated that a material change “at a minimum includes sharing consumer information with third parties after committing at the time of collection not to share the data If the policy is not strict enough, then consumers, regulators, and the press may criticize the company for its failure to protect privacy. If a policy is too strict, then open-ended statements or overly ambitious security promises can result in legal penalties or reputational problems if the organization cannot satisfy its promises.

The FTC wants businesses to obtain affirmative consent from their customers when they make material adverse retroactive changes to their privacy policies.