Write privacy policies for Scorecards and GRACE

[zarino]

Separate PPs for Scorecards and GRACE, linked to from the site footers somewhere.

Don’t need to be anything ground-breaking. Use Local Intelligence Hub privacy policy as an example. There is more info about privacy policy requirements on the mySociety wiki.

[zarino]

Draft Scorecards privacy policy:

https://docs.google.com/document/d/1vSe9-cSRbrMvsLEDn4oxKJOF4_-1CXfsMs12iPxAPkg/edit

Draft GRACE privacy policy:

https://docs.google.com/document/d/1vmw5Va5nwoA2u2ahefSg6zLD246DL280Q2yaAFz6ZnQ/edit

Need review from CEUK and Louise/Sam.

[zarino]

Discussed this today with @sagepe. Summary:

• @sagepe to go away and think about whether mySociety should be described as a joint controller with CEUK, or whether CEUK are the controller and mySociety are the processor.
  • Note for future – we may want to include data controller/processor decision in our future MOUs with partners, to make this clearer from the outset.
• @zarino to check missing a data retention period for GRACE user accounts data. Could we delete the accounts data (but probably keep the accounts themselves, just without emails or names) once the Scorecards are published?

Aside from those two issues, both drafts seem fine.

@sagepe also noted that we’re missing a privacy policy for CAPE. I’ve created a ticket for that here: #554

[zarino]

Legitimate Interests tests now on the wiki at: https://wiki.mysociety.org/wiki/GRACE_GDPR_Legitimate_Interests_test and https://wiki.mysociety.org/wiki/CouncilClimateScorecards_GDPR_Legitimate_Interests_test.

TODO:

• @zarino to fill in volunteer and council officer data section of GRACE legitimate interests test

[zarino]

@sagepe I‘ve filled in the top half of the GRACE legitimate interests test wiki page – let me know if there are any changes you think I should make!

[sagepe]

I've put a comment on the Talk page, as I think it would be good to track that discussion there for the sake of a complete record.

[sagepe]

The GRACE LIT looks good to me. I've made a couple of slight tweaks to the Privacy Policy based on that.

[zarino]

The Scorecards privacy policy has been merged into the scorecards-2023 branch, so will go live with that on 18th October.

And the GRACE privacy policy was deployed this morning.

So I think we’re done here!