↓Skip to main content

Burn the legalese: why I built Policy Bonfire

·3 mins
Data Protection GDPR Plain Language Policy Bonfire Legalese

Policy Bonfire — burn the legalese

I’ve just launched policybonfire.eu.

At the very top of the page, you’ll find some text that should be quite familiar to any data protection practitioner. It’s Article 12(1) of the GDPR. I put it there as a reminder because it seems to be pretty much ignored.

We’ve come a long way from the worst of the legalese. Many notices have genuinely improved. But open almost any large company’s website and you’ll still find the link, in the smallest possible font, at the very bottom of the page, buried under a list of other links nobody reads. If you do click it, what loads is often still almost unreadable. Not just because of the complex language, but because of the length, the structure, and the quiet implication that this document was never really written for data subjects.

That, to me, is totally disrespectful. Disrespectful to customers, students, patients, passengers - whatever the sector you work in. Employees. People whose data are being processed, often without much practical choice in the matter.

A word on terminology #

And while we’re here: “privacy notice.” Is that term not simply a reflection of how many practitioners have been through the big so-called ‘industry standard’ certification programmes resulting in the Americanisation of European data protection? Yet, as we all know, the GDPR doesn’t mention “privacy notice” anywhere.

So what is Policy Bonfire? #

I built policybonfire.eu as a bit of fun — but with a serious message underneath. If you’ve ever been in a conversation with a legally-oriented practitioner who seems to have read every article and recital of the GDPR yet somehow struggles to apply Article 12(1) in plain terms, you’ll know the situation I’m describing. The site is about burning that approach. Burning the legalese.

It’s an entertainment site, not a data protection tool. There’s a translation function that will render legalese into plain language. Please use it with caution if you’re thinking about simplifying an actual notice, it’s illustrative rather than definitive. But there are also a few other ‘voices’ you might want to try, just for the fun of it.

Practise what you preach #

I also wanted the site itself to reflect data protection principles in practice because there is a pattern in this sector of organisations that are very precise about quoting articles and recitals, yet find it rather difficult to apply those principles to their own practices.

Please have a look. And please do feel free to let me know what you think of it and challenge me on any of it.

If you found this useful, the Purpose and Means newsletter covers data protection, GRC, and AI governance — fortnightly, in plain language.

Purpose and Means works with organisations on data protection strategy, governance, and compliance - going beyond the legal text to focus on how things actually get done. If you would like to discuss what this means for your organisation, book a call or explore our services.

Author
Tim Clements
Tim Clements is Business Owner of Purpose and Means, a data protection and GRC consultancy based in Copenhagen, operating globally. He helps data protection and GRC leaders simplify complexity into actionable strategies, providing tools, training, and support to engage and influence across the organisation. Tim is a Chartered Fellow of the BCS (British Computer Society).

Browse by Topic

access controls accountability accountability frameworks ai act ai ethics ai governance ai infrastructure sovereignty ai literacy ai regulation article 12 article 13 article 22 article 25 article 28 article 30 article 32 article 35 article 46 article 5 article 6 article 7 audit and assessment automated decision-making awareness awareness campaigns behaviour change beyond legal board level board reporting case law change management chief people officer cloud infrastructure compliance monitoring consent cookie compliance cross-border transfers customer success dark patterns data accuracy data breach data breach notification data flows data mapping data minimisation data processing agreements data protection data protection by design data protection culture data protection day data protection hero data protection leader data quality data residency data retention data science data sovereignty data subject rights datatilsynet deceptive design design thinking direct marketing dora dpia education employee data employee engagement enterprise architecture eprivacy esg executive communication external legal counsel field talk finance and banking gdpr gdpr at 10 generative ai governance grc healthcare history horizon scanning hr and data protection hr and employment incident response information security intellectual property internal communications international transfers lawful basis leadership legalese lego serious play machine learning marketing newsletter nis2 passwords plain language planning policy bonfire privacy by design privacy culture privacy notice privacy policy product management profiling public sector purpose limitation quantum computing records-of-processing regulatory guidance risk management risk reduction ropa sales security software development special category data standard contractual clauses strategic planning sub-processors supply chain sustainability system design third-party risk training training design transparency trend radar ux design vendor management visual communication weak signals workshop facilitation

Related Posts