Does Trade Me deserve the Privacy Trust Mark?

At the beginning of 2018 in New Zealand there was a competition to design the Privacy Trust Mark for the Privacy Commission. This trust mark was to be used online

to highlight excellent privacy practice in a product or service

The winner was a graphic design artist from Christchurch and the final design is very nice. Then the first two recipients of the trust mark were announced. One was a government led initiative to prove your identity online called RealMe. The other is a New Zealand online auction site called Trade Me. They deal with a lot of personal information as defined by the Privacy Commission.

Personal information is any information which is about an identifiable individual. In other words, it’s anything which tells us something about a specific individual. The information does not need to name the individual, as long as they are identifiable in other ways, like through their home address.

Curiously there appears to be no definition of personal information in the 1993 Privacy Act itself. Although there are some definitions of specific personal information in the schedule for information sharing between government departments. Either way, does Trade Me actually deserve the Privacy Trust Mark? Having it in the news will cause a lot of people to trust them and not to read their privacy policy. So what does that policy say about the information they gather and how they deal with it?

Information gathered by Trade Me

Browser used
CV details in Trade Me jobs
Delivery addresses
Demographic information if required
Device used and information about it
EXIF data from photos
Firearms license number if needed
Geographic location when using
IP Address
Information from third parties about you
Listed content including after the listing has expired
Mobile device performance analysis, usage behaviour, technical information about the device, firmware and carrier.
Operating System used
Partial Credit card details
Phone call recordings for six months
Registration details – name, gender, address, email address, etc..
Use of website including viewings and searches
URL you came from
URL you are leaving to

What they use it for – The really long list

Accounting
Allow advertisers and recruiters to contact you about jobs
Allow advertising clients to place remarketing cookies
Allow Google to target ads to you
Automatically populate your Trade Me Job Profile
Behavioural analysis
Contact members
Create your Trade Me Jobs Profile
Customer relationship management
Deliver information and fresh content specific to the users interests
Display your CV information to selected recruiters and advertisers
Enable third party access through API
Enforce or apply their terms and conditions
Ensure Afterpay can enforce any contractual rights given for Afterpay’s benefit under the Afterpay terms for Trade Me sellers.
Facilitate payments under the Afterpay Service
Give seller your address with permission
Help display advertising to the user
Help process a refund, chargeback and/or reversal having used the Afterpay Service
Help with resolution of a dispute having used the Afterpay Service
Identify users abusing the Trade Me service
Improve the experience of using Trade Me
Internal research purposes
Make services relevant and personalised to your interests
Marketing
Other parties under the Buyer Protection Policy
Personalise the experience
Promoting and marketing other Trade Me products and Services
Protect the rights, property, or safety of Trade Me Limited its users or others
Provide Trade Me with research information
Promote listed content
Promote affiliated partners
Protect members
Publish listed content (eg; an auction)
Recommend jobs to the user
Remarket relevant ads to you after you leave our website (including using your Google Account information if you have one)
Report suspicious or potentially fraudulent activity on the Website in connection with the Afterpay Service
Send opted in emails
Share credit card details with DPS or Paystation
Share information with Index Exchange, Rubicon Project or Pneumatic
Share information with Salesforce DMP
Show you ads that are specific to your interests while you browse Facebook
Target Adwords advertising
Third Party services
To better understand the use of photos on our site and to help us provide a safe marketplace
To provide the service
To tie their information with third party services
To stop fraud
Track users on Trade Me
Use third parties to display or use listing content
Used to deliver the right content to you (cookies)
Verification of firearms license
Verify your identity

Apologies for the long list but there was a lot of information in their privacy policy. I have highlighted some of the worst offenders in my eyes. It has taken two hours to get to this point and this is precisely the reason the Privacy Trust Mark is so important. Because people aren’t going to go through the policy, they are going to look at the trust mark logo and assume Trade Me protects their privacy. And maybe it does, but they are exposing your device to third party cookies, third party information gathered through the API, and providing Google with information. Gathering information to provide a better service to the user does not involve using that information to target advertisements at the user. If they are letting third parties advertise to you using your information then they aren’t providing a service to you, they are providing a service to someone else.

Of course, they didn’t receive the Privacy Trust Mark for their privacy policy. In fact Trade Me didn’t receive the privacy tick for their website. They were awarded it for one particular product which was their Transparency Reporting. This wasn’t widely reported in the media. To show a couple of the headlines you would think the entire site had been awarded the mark.

Only one of the above articles specifies it was Trade Me Transparency Reporting that received the tick. It was a media coup for Trade Me Auctions with thousands of people reading they had received the mark. They didn’t. And if you look at the list above you can see why. In the end it was just fake news.