856102 - Privacy review for new vendor

Status: RESOLVED FIXED

(Privacy Graveyard :: Vendor Review, task)

Description

[Cori Schauer]

Attachment: Experientia SOW

The User Experience Research team is hiring the consulting firm, Experientia, to help us conduct user research in Europe for Firefox OS. We need a privacy and security review. I've attached the SOW for reference.

This bug should reference Bug#856099 - the legal bug for contract review.

Comment 1

[Stacy Martin [:stacy]]

Attachment: Mozilla Vendor Privacy Questionnaire

Hi Cori - Can you send them this questionnaire?  They can mark n/a to anything that doesn't apply - it's a standard form we use for all vendors who have access to personal data.

Comment 2

[Cori Schauer]

Attachment: Experientia's answer to Privacy review

Hi Stacy & all - attached is Experientia's responses to the Privacy Review questions. Thanks!

Comment 3

[Stacy Martin [:stacy]]

Hi Cori - This looks good.  Can you attach a sample of their release form?  Also, can you ask whether age can be used rather than birth date, since age is less sensitive?

Comment 4

[Cori Schauer]

Hi Stacy - Actually, we'll use our Mozilla release forms instead of their release forms. Do you still need a copy of their form? 

In terms of age v birthdate, this is used for recruiting purposes and we can make sure to collect age rather than actual birthdate. That is a very easy change to make. I will let them know.

Comment 5

[Stacy Martin [:stacy]]

Hi Cori - Yes, please attach our release form.  I think I've reviewed it before, but it's been a while.  Thank you for changing birth date to age.

Comment 6

[Cori Schauer]

Attachment: Mozilla Release form

Hi Stacy - Here's our release form.

Comment 7

[Stacy Martin [:stacy]]

Hi Cori - This looks good.  You can move forward with this vendor.  

Do we make any representations to participants about how we will store their information, how long we'll keep it, etc?  I'm wondering if we could state that we will handle it in accordance with our privacy policy and add a link to our policy to the release form?  I'll mention the idea to legal.  It's not to hold up your project, just something to consider going forward.

Comment 8

[Cori Schauer]

Hey Stacy, I don't think we do this right now, but is an interesting thing we should probably do. Liz will definitely know more. Thanks!

Comment 9

[Liz Compton [:liz]]

Hi Stacy - That's a good idea. Do you mind submitting a legal bug to update the user studies release form with a privacy policy reference so it'll on my radar?

Comment 10

[Stacy Martin [:stacy]]

Closing as complete.  I think we'd decided not to add the privacy policy link to the release form.