An analysis of privacy policies in Sri Lanka

Abstract

This article focuses on privacy policies of websites and attempts to understand how they have been designed. A study looking at the privacy policies of US firms was conducted for the first time in 2016 by Professor Marotta-Wurgler. While the study provides a look into how the global north considers privacy, there is nascent scholarship in this regard for the global south. I look to the global south – Sri Lanka, in particular – to understand to what extent privacy and the well-being of consumers feature in designing privacy policies of various industries in the country. I look at 20 privacy policies across four industries, cloud computing, banking, supermarkets, and transport services. I conclude that while firms abide by some international standards even without legal obligation, there is room for improvement. There is little standardization within and across industries with international firms laying down higher privacy protections on average. The article finds most policies to be long and incomprehensible. I conclude that while incorporation of international privacy standards to varying degrees absent legal compulsion is admirable, there is more to be done to benefit the consumers for whose welfare privacy policies are drafted in the first place.