Glossing over privacy considerations can bite a developer in the app

The mobile environment, along with the new app economy it has generated, is a rapidly evolving new frontier

Mobile applications can be cheap and cheerful, developed for as little as a few thousand dollars in just weeks or months. But in the rush to get them to the highly competitive market, some enterprising developers may be overlooking established rules around user privacy — a risky move that can lead to public relations nightmares and even the app’s ultimate failure.

More than half of U.S. app users have either uninstalled an app or declined to download it in the first place over concerns about how their personal information would be used, according to a September report by the Pew Research Center.

Partly in response to that research, the Office of the Privacy Commissioner of Canada, along with its provincial counterparts from Alberta and British Columbia, published a document outlining good practices mobile app makers should follow to avoid that sort of fallout.

“The mobile environment, along with the new app economy it has generated, is a rapidly evolving new frontier,” stated the guidelines, released in October. “As with past frontiers, it is filled with both richness and potential but also risks.”

“In Canada, there is an expectation and a legal requirement that app users are to be informed of what information is being collected, used and disclosed about them… and for their consent to be meaningful,” the guidelines said, noting that the popularity of apps means increased scrutiny of privacy practices going forward is likely.

James Sapara is the chief technical officer at Picatic E-ticket Inc., a Toronto-based online ticket sales company. In September, the company launched EventTilt, a new product that lets organizers crowdfund an event to canvas interest and demand before committing to put it on.

Given its business, Picatic collects a lot of potentially sensitive information from both event promoters and attendees.

“One of the important things is to be clear about what you intend to do with information,” Mr. Sapara said.

He noted that working with a merchant account provider that handles credit card transactions may force some companies to be more proactive about developing privacy policies from the start as the merchant provider often requires it.

“A lot of startups are super lean and super fast, so I would say that it’s possible that some startups would probably miss some of those things,” he added.

“It is very difficult for startups to navigate around privacy rules,” said Joshua Gans, chair of technical innovation and entrepreneurship at the Rotman School of Management. “I think a lot of startups end up not worrying about it, in the idea that they will have to deal with it if they become as successful as Facebook.”