Polis: Update privacy policy

[patcon]

Re-ticketed from https://github.com/pol-is/polisServer/issues/222 (Related: https://github.com/pol-is/polisServer/issues/227)

This came up in the kickoff community call on 2020-04-03.

• @metasoarous: ToS, privacy, etc need to be changes, re: GDPR #todo
  
  
  
  • @crkrenn: has already dealt with this on private branch
  
  

Public page: https://pol.is/privacy

Source code: https://github.com/pol-is/polisClientAdmin/blob/master/src/components/privacy.js

@crkrenn offered to share. Any update on that Chris?

[patcon]

@joshsmith2 -- ohai! 🖖-- was asking about this in Gitter chat:
https://gitter.im/pol-is/polisDeployment?at=5e99a86cd65bcf75b5cb0101

Good afternoon all - a slightly tangential Pol.is question here . My charity's been working with Dynata, a polling company to help recruit people for surveys (I've built a tiny integration between their systems and embedded Pol.is, which I'm happy to share if anyone finds themselves in the same position) but they've raised a question about the Pol.is privacy policy - https://pol.is/privacy. This was last updated before GDPR which apparently causes an issue, and means they can't go ahead. Talking to Colin it sounded like something which was being worked on - does anyone know if there's a document floating around with an updated privacy clause; or has anyone used updated terms in their own projects?

[joshsmith2]

Oh hey! Thanks for raising this as an issue, it's a real help. Let me know if there's anything I can do to help out with this.

[joshsmith2]

So the policy shared by @crkrenn on Gitter, used for DemocracyGPS, looks perfect for this; the full text is here:

https://app.termly.io/document/privacy-policy/00d63dff-6ec2-49f4-ba4b-80feb54182aa

Update - seems this uses boilerplate from termly.io, which requires a free account: https://app.termly.io/user/products

[patcon]

From Gitter chat msg:

@metasoarous says that pol.is has a new privacy policy written already, but not on live site yet. Will share updated doc asap.

[patcon]

https://klaro.kiprotect.com/

[colinmegill]

The OSS codebase should take a config URL, set at build, which points to
static content for privacy and terms. Privacy and terms should be removed
from all repos.

On Fri, May 8, 2020 at 8:47 AM Patrick Connolly [e-mail]
wrote:

https://klaro.kiprotect.com/

—
You are receiving this because you are subscribed to this thread.
Reply to this email directly, view it on GitHub
https://github.com/pol-is/polis-issues/issues/132#issuecomment-625798692,
or unsubscribe
https://github.com/notifications/unsubscribe-auth/AANQGGKQSTIHIKXPL5SLQJTRQP5NTANCNFSM4MK3T6LA
.

[patcon]

Ah sounds good. Assuming sharing third-party text in our docs can help ppl know what to do (like pointing to @joshsmith2 / Demos UK's version in their repo, for instance)

[colinmegill]

To clarify, you want to check in 'example' TOS / Privacy in the docs
section for others to use as a 'starter'?

On Fri, May 8, 2020 at 12:29 PM Patrick Connolly [e-mail]
wrote:

Ah sounds good. Assuming sharing third-party text in our docs can help ppl
know what to do (like pointing to @joshsmith2
https://github.com/joshsmith2 / Demos UK's version in their repo, for
instance)

—
You are receiving this because you commented.
Reply to this email directly, view it on GitHub
https://github.com/pol-is/polis-issues/issues/132#issuecomment-625898873,
or unsubscribe
https://github.com/notifications/unsubscribe-auth/AANQGGJKPQA6Q4UM6SE7XYLRQQXQNANCNFSM4MK3T6LA
.

[patcon]

Rather, just linking them, not committing them to repo where we'd have to keep them up-to-date. So not a total blank slate. But intentionally not appearing to offer something we're not responsible for

[patcon]

From Gitter convo:

patcon: Re: tos/privacy. I might suggest version-controlling a default markdown, and have a config val like "tos_contents" accept both a local file (default) but also a url to a plaintext file (e.g. a gist). So ppl don't need to fork and host their own repo for the entry customization. It gets built into a page from markdown or plainttext

metasoarous: Oh; Yeah, they could be templates by default, and you just plop in your company name etc as config. Really, legal departments need to be reviewing this stuff though, and most will probably require amendments. But could be useful for small/test deploys.

colinmegill: Before we commit to this, do you mind checking Mozilla’s framework for this — are their policies creative commons licensed? (those legal terms as well as other docs)

(https://www.mozilla.org/en-US/privacy/)

colinmegill: In short, I’m not completely comfortable with this. I think a bit of pain here is warrented, because data is being collected. So there should be an organization which is accountable. This also presents liabilities for indiviudals gathering data if they’re not considering it

[patcon]

and seems like privacy policy falls under "website content" which is ambiguously CC BY or CC BY-SA according to this: https://www.mozilla.org/en-US/foundation/licensing/

Code of Conduct and related policies are specifically under CC BY-SA:
https://www.mozilla.org/en-US/about/governance/policies/participation/#license