Create privacy policy checklist

[afeld]

Placing under the Benefits repository for lack of a better place, and for easier planning in our board. Will likely move.

For various Cal-ITP projects:

• How do we ensure there's a comprehensive privacy policy?
• Whose privacy policy applies when? There are a number of them that come into play:
  • Monterey-Salinas Transit
    • Draft copy (revision?)
  • Caltrans
  • DMV
    • Currently linked from the Benefits footer
  • CCJPA
• Covering things like:
  • FERPA
  • Cookies

@vykster is looking for a checklist that says things like "If there's analytics, you need X and Y." Some of this may belong in a Terms of Service / Conditions of Use page instead. Resources:

• Payments team research
• Compiler lawyer and security consultant

[vykster]

Immediately we want to answer the questions of (1) is our current approach (linking to the hosting agencies policy in the footer) sufficient? (2) what is our approach if we move hosting? (3) what is our approach for small static sites like calitp.org and reports.calitp.org?

and yes the checklist/ decision flowchart might be a good way to help organize our thoughts and not just answer these questions but for new and future apps.