According to the European Commission’s GDPR guidelines, the phrases below are not sufficiently clear as to the purposes of processing. (We took these examples directly from the document.)
-
“We may use your personal data to develop new services” (as it is unclear what the “services” are or how the data will help develop them)
-
“We may use your personal data for research purposes” (as it is unclear what kind of “research” this refers to)
-
“We may use your personal data to offer personalised services” (as it is unclear what the “personalization” entails)
-
On the other hand, statements like these are considerably better: "We will keep track of your shopping history and use information about the goods you have already purchased to recommend goods to you that we think you will also like." (It is obvious what kinds of data will be processed, that the data subject would see targeted product adverts, and that this will be made possible using their data.)
-
“In order to better understand how people use our website and make it more intuitive, we will keep track of your most recent visits to it as well as how you navigate through its various sections. (It is clear what kind of data will be processed and the kind of analysis the controller is going to conduct.)
-
“It is clear what personalization entails and how the interests attributed to the data subject have been identified. We will keep track of the articles on our website that you have clicked on and use that information to target advertising to you on this website that is pertinent to your interests, which we have determined based on articles you have read.