Rewriting your Privacy Statement and Cookies Policy

I wrote Privacy Policies - which covered the use of Cookies - for my websites and blogs yonks ago.

Of course, the advent of GDPR has meant that they now ALL need to be updated to become compliant with GDPR.

However what I did not anticipate was that I would be writing and re-writing the Privacy and Cookies Policies over and over again. (For the record the one for this blog needs rewriting again and my latest / most up to date version is on Art Business Info. for Artists - but that needs more work!

That's because although I read the guidance and knew pretty much what I needed to do it took until 24-25th May before most 'well-informed' people published their new Privacy Policies - which means that I now have a huge reservoir of policies to look at to see which work best for me.

The main difference to what I had before and what I need now is that the Policy now needs to be 

• spelt out systematically 
• sit under heading(s) which say 'Privacy Statement' and 'Cookies Policy'.

If you haven't even started writing a Privacy Policy 

I've  decided that when it comes to rewriting you can't fail if you reference the Privacy and Cookies Policies of certain leading websites.

Which is why below you can find links to some of those I feel certain will have got it right. Have a read and then decide what works for you.

Information Commissioner's Office

Where better to go than the website of the Regulator?

• Privacy Notice (over several pages - but an easy read)
• Cookies Policy - their deeply nerdy goody two shoes approach has every cookie nailed and explained!

Gov.UK

Always worth checking out what they are doing on the Gov.UK website - they should be leading from the front! This is Gov.UK's

• Privacy Notice
• Cookies Policy

It's kept very streamlined and simple. very much a recommended read. Here's its take on Google Analytics.

Google Analytics stores information about:

• the pages you visit on GOV.UK

• how long you spend on each GOV.UK page

• how you got to the site

• what you click on while you’re visiting the site

We do not collect or store your personal information (for example your name or address) so this information can’t be used to identify who you are.
We do not allow Google to use or share our analytics data.
Google Analytics sets the following cookies.

Name	Purpose	Expires
_ga	This helps us count how many people visit GOV.UK by tracking if you’ve visited before	2 years
_gid	This helps us count how many people visit GOV.UK by tracking if you’ve visited before	24 hours
_gat	Used to manage the rate at which page view requests are made	10 minutes

The Royal Family

I just assume they have somebody advising them who knows what they are doing!  Here are the policies for the website - AND their operations more generally, which interestingly artists might find interesting given there is a lot of get out and about and interact with other organisations.

Here are their:

• Privacy Policy
• Note in particular the two paragraphs relating to cookies on the Royal Family website and Google Analytics cookies - this is what I call stripped back!

The National Gallery

I thought it worth checking what some of the major art organisations were saying.

• Privacy Policy - set out in chunks with a separate page for each section
• Cookies Policy - also chunks - the advantage being you can get straight to the bit you want. They have a complete breakdown of all the cookies - which means you have a good chance of finding the ones you need to list

Google

Every Google product seems to reference the Privacy Policy for the country you are located in.

This is the Google Privacy Policy for the UK - with the link found at the bottom of the Feedburner website which I use for email subscriptions to this blog.

Suzanne Dibble

Suzanne Dibble is the lawyer who has grown the GDPR For Online Entrepreneurs (UK, US, CA, AU) Facebook Group from zero to 35,000+ members since February. It's probably the most sensible GDPR Group around - plus it has lots and lots of videos addressing different aspects. Worth a wade through - but a warning - you will be overwhelmed!  It's targeting small businesses more than sole traders.

You haven't got a hope of copying either of the following for her business website (far too canny for that!) - but they are both definitely worth a read

Here is her:

• Privacy Policy
• Cookies Policy

My recommendation. Think of a website and operation that is very like you - and have a look at what they've got to say.

CAUTION: There is no way of knowing who has got it right. However taking a look at the websites of those who SHOULD be setting an example gives us a good steer towards getting our statements right.

and finally.....

All the messages coming out of ICO suggest that they are very much looking towards helping small businesses rather than fining them.

Don't ignore GDPR - but also don't anguish over whether you've got it all 100% right.  If you got it wrong then all the PR suggests that they will be looking to provide guidance in the first instance

Artists and GDPR - what would you like to tell the EU (and ICO)?

This is your opportunity to comment on what you think of GDPR and its impact on artists and small art groups/organisations.

I was asked yesterday to provide a comment to a German news organisation and this morning sent them a written response to the questions they asked - see below.

But as an artist or illustrator or arts organisation WHAT DO YOU THINK?

• are you aware of GDPR?
• do you know what you have to do to comply with the new regulation as from Friday 25th May 2018
• have you done anything to date?
• are you planning to do anything
• how do you feel about it?

Please comment below - and you never know your comment might also be incorporated!

Reference to previous posts below (re. GDPR background/actions) and a small treat at the end of this post for those who get that far!

• August 2017: Is your art organisation or business ready for GDPR - the replacement of the Data Protection Act?
• March 2018: Got the GDPR Jitters? 10 things you need to know as an artist / art society / art gallery
• May 2018: Art Galleries and GDPR

plus my page on Data Protection - General Data Protection Regulation ​for Artists and Art Organisations

I think maybe the ICO website is having a few problems with demand for information
with only two days left before the Regulation becomes operational

___________________________________

questions

1. How might the GDPR negatively effect artists and artist organizations? Does simple human oversight and a failure to 'opt-in' before May 25 mean that artistic communities could lose contact with many of the people they rely on to survive? 
2. Why has the 'one size fits all' roll-out of the GDPR been problematic for artists and art societies? 
3. Anything else you'd like to add?

my response

The EU comprehensively failed to assess the impact of this change in regulation on the sole trader - and artists are no different from any other sole trader in this respect.

The definition I've seen of a micro business is one with less than 250 employees. We all know full well there are very many active sole traders and and thriving small businesses and trading operations which have anywhere between 1 and 10 employees. Two years ago when this new regulation was approved, both the EU and the national agencies responsible for the implementation of this new regulation totally failed to communicate effectively with sole traders and the real micro businesses (i.e. those with less than 10 employees). As a result, they have only succeeded in frightening them and sending them into a spin with very little time left to implement change. I'd liken it to the complete insensitivity of the disastrous change in VAT levied on digital products in 2015 (such as eBook and video tutorials) which was made without any thought whatsoever for the implications for the sole trader.

The EU needs to stop ignoring the fact there are HUGE numbers of sole traders - including artists - operating within the EU.

• Sole traders are periodically strangled by EU red tape designed to catch the very large organisations who sidestep and/or ignore regulations and tax.
• Of course, the EU should tackle the lack of proper security of personal data (and evasion of tax etc.) by corporate entities - but they need to make robust and realistic assessments of the impact of their "one size fits all" regulations on sole traders and extremely small businesses in the process! 
• The level of change is seismic in its impact for a sole/small trader such as an artist compared to companies which can afford to employ individuals to tackle this topic. It's very likely to succeed in causing much anxiety and choking off economic activity at the grass roots.

However due to the very poor communication, I suspect most artists are still not aware that ANY change is happening on 25th May. Very many will not be aware of the complete range of changes they are expected to make. They will undoubtedly carry on as before. Whether this becomes a problem for them in the future is hard to say. I certainly don't think the regulators should be spending their time chasing after artists who probably don't understand much of the language and terms that the regulations and guidance is written in. 

Lawmakers and regulators should very definitely get their priorities in order and focus all their efforts on holding the corporate giants to account!

and finally......

I've been collecting GDPR Privacy Policies - and if you are at the screaming ab-dabs stage with yours you might enjoy reading this one - The Writers HQ - Privacy Policy