Sample privacy impact assessment: a website redesign and its form

Example Renovation, a residential contractor, is redesigning its existing website. The new site will include a quote request form where visitors enter their name, email address, phone number, the address of the work, a description of their project and photos of their home. Example Renovation undertakes this project to receive quote requests through its website and to measure traffic on the site. The information collected will not be used for any purpose other than these two.

This assessment covers the personal information handled by the redesigned website. That includes the quote request form, the protection of the form against bots, the delivery of requests by email, the hosting of the site and of the database where requests are kept, and the measurement of site traffic. The project is expected to involve between 100 and 10,000 persons, and the information is handled in the cloud. The assessment does not extend to other systems or activities of Example Renovation that are not described here. In particular, it does not cover how quotes are prepared or followed up once a request has been received.

Personal information is collected directly from visitors to the website. Everyone who browses the site has their IP address and the pages they visit processed by a Canadian audience measurement tool, located outside Québec, which produces traffic statistics without setting cookies. Visitors who fill in the quote request form provide their name, email address, phone number, the address of the work, a description of their project and photos of their home. Before the request is submitted, the form is checked against bots by Google's reCAPTCHA service, which operates in the United States. Visitors are informed of this processing, and the privacy policy is being updated to name the vendors involved.

Once submitted, each request is stored in the website's database and is also sent to Example Renovation by email. The database and the site itself are hosted by a website host in the United States. The email is delivered through an email delivery service, also in the United States. Example Renovation has a written agreement with each of the four vendors.

Within Example Renovation, access to the information is limited to staff who need it. What comes back to Example Renovation is each quote request, received by email, and the traffic statistics produced by the audience measurement tool. No decision about visitors is made exclusively by automated means. No retention period has yet been defined for the requests kept in the database and in email, or for the traffic data, and this remains to be determined.

The assessment brought two findings to light. First, no retention period has been defined for the information collected through the website. Second, it remains to be confirmed whether Example Renovation is able to communicate personal information to a person who asks for it in a structured, commonly used technological format. The assessment also identified three risks. The main one is keeping information longer than necessary, judged of medium severity and high likelihood because no retention period exists. The other two are the processing of information outside Québec without adequate protection and unauthorised access to the information, each judged of medium severity and low likelihood. These risks arise in a context where three vendors process the information in the United States and requests may contain photos of the home and the address of the work.

Example Renovation adopts the five measures set out in this document to address these findings and risks. It will review their implementation with Nadia Example.