19.2 Rules governing storage of tracking data
The New Zealand Web Standards 2.0 were released in March 2009 and replace the previous version, the New Zealand Government Web Standards 1.0 (below). See Meeting the standards for more information.
The Standard
19.2 If tracking data is being recorded (e.g., such as that held in a temporary client-side cookie), then the agency must place on the site a disclaimer stating (as a minimum):
- That tracking data is being recorded,
- What processes are being utilised to collect the data
- How the data will be stored
- The benefits to the user community of the web site resulting from the collection of such data.
- How a user can prevent this data from being collected
- The impact (if any) on the experience the user may have with the web site, if the user chooses to disable the tracking data.
Guide to this standard
This standard is in the context of the definition of Tracking Data in the Glossary of Key Concepts.
Processes utilised to collect the data can be described by an easily understood statement (minimising technical jargon) of how your agency is initiating and establishing the data-recording process for the web site.
For example:
"A script to run in your browser, which creates a file on your computer (referred to in technical circles as a "cookie") that contains a randomly generated ID. The ID is used to track which pages on our web site you have visited and also assists identifying you when returning to our web site. The file on your computer does not identify you by any personal information. No data in this file can be used to identify you in our agency should this file be compromised by a third party."
Also include any details associated with the specific reasoning for the recording of such data. For example, utilising a third-party organisation who provide analytical information to your agency via collection of tracking data on your agency’s behalf;
"Information is recorded about the pages you view, and basic information about your computer, such as the type of browser you are using, your screen resolution and your computer's internet address (IP address). This information is shared with Acme-analytics, a company that our agency has employed to provide web site traffic analysis processes for us."
How the data will be stored can be described by an easily understood statement, minimising technical jargon. For example, in the case of data being recorded for traffic analysis purposes:
"The aggregate data collected is stored in a database managed by Acme-analytics on behalf of our agency (include your agency name). Only authorised staffs within our agency have access to the reports created by the analysis software. Acme-analytics operates and is bound to a strict privacy policy, which they have signed with our agency."
Rationale for this standard
Because of the requirement to be able to disable the continued recording of tracking data, a site should not have its functionality dependent on this data. Information about the recording of tracking data and user choices supports the government value of transparency.
