4 4.3  policy’. This policy should be written in easy-to-understand language, spelling out the implications of when the user’s data would be shared, with whom, and why. They should be clearly made known to all staff, particularly those with accessnto sensitive data, and the sanctions for breaching them known. The International Standards and Guidance in section D below set out what issues to address when developing their policies and systems. 354 Ensure that businesses’ terms and conditions or privacy policies are publically available so users or customers are aware of what personal data may be collected or shared. The policies should be available in Burmese and local languages. Putting in place robust data protection standards is a good way for local companies to show they are ready to meet data protection requirements from business partners, trading partners and users. Web Based Services   Develop and promote privacy controls: Overall digital literacy in Myanmar remains low. Many users are interacting with web-based services for the first time. Some international companies have controls in place that allow a user to manage his/her ‘digital footprint’ online in addition to their broader online experience. A large majority of users in Myanmar are not familiar with these features. On social media, privacy management controls allow the ability to selectively share or restrict information, including access to photographs, contact information or profile accessibility (e.g. public and private settings). For email communication such as newsletters or mailing lists, this involves the ability to unsubscribe or customise subscription settings. Companies need to raise awareness of these features through appropriate media and ensure these features are available in local languages. Develop and promote content-reporting mechanisms: Abusive or offensive content can violate a user’s privacy. Larger social media platforms now maintain community standards, which outline acceptable use online, while also providing guidance to users on how to address violations of these standards in the case of prohibited content or behaviour. Content reporting mechanisms allow users to report abusive or invasive content to platform moderators. For first time users, understanding how and when to report content is a critical part of ensuring a safe experience online. Similar to privacy controls, companies must raise awareness of these features through appropriate media, and ensure that community standards and reporting tools are available in local languages 355. D. Relevant International Standards and Guidance on Privacy Issues Relevant International Standards:  Asia Pacific Economic Cooperation Group (APEC) 2005 Privacy Framework  EU Data Protection Directive 95/46  EU Directive on Privacy and Electronic Communications 02/58 354 See for example, European Commission, “ICT Sector Guide on Implementing the UN Guiding Principles on Business and Human Rights“ (2013), pg. 21, 45-46. 355 In September 2015, Facebook launched a Burmese version of its community standards ‘Facebook rules get local to tackle abuse’, Myanmar Times, 10 September 2015 164 PAGE CHAPTER 4.3: PRIVACY