A Pretty Good Privacy Policy
Over the next month I’m going to work on drafting a Pretty Good Privacy Policy. I’ve been asked by my friends at Nxt Level You how one should go about creating a transparent, easy to understand privacy policy that meets the legislative requirements here in British Columbia, Canada, but also considering international privacy laws.
Most tech startups in my experience simply cut & paste a privacy policy from someone else, which is entertaining to see technical inaccuracies and even spelling and grammar errors in privacy policies propagate around the internet as a result. I’m excited to work with this team to draft something that can be used by others in a way that that not only keeps the legal types happy, but I want to end with something that is easy for users to easily understand.
During my quest, I will be reaching out to experts around the globe, and documenting the process here as I go. The hopes at the end is not only to have drafted a privacy policy for Nxt Level You, but also have a template for anyone reading this to use when drafting their privacy policy.
The two contextual considerations in my process are jurisdiction, and sector. This privacy policy will be intended for a business located in British Columbia, Canada. Nxt Level You is a wellness business, so it will be hosting sensitive health information, which means that we’ll need to comply with applicable global health privacy laws. Being in the tech sector and with a desire to scale, two other notable considerations will be around big data, and artificial intelligence/machine learning, which each have their own unique properties around privacy.
If you have any recommended starting points for someone drafting a privacy policy, please add them in the comments.
Need this translated for your organization? PrivaSecTech offers confidential briefings, policy reviews, workshops, and privacy/security advisory for teams that need to decide what to do next.
