A team installs a free website analytics plugin that sends resident interaction data to a vendor, skipping data-processing agreement review. What governance expectation applies?
Select an answer to reveal the explanation.
Short Explanation
“Free” is not the same as “harmless.” If a plugin ships resident clicks to a vendor, it still needs the same privacy and contract look-over as a pricey platform. Price tags do not waive risk.
Full Explanation
A free website analytics plugin that sends resident interaction data to a vendor still triggers governance expectations: third-party tools that process data need contractual and privacy review regardless of price. “Free” does not mean risk-free for civic websites that touch resident behavior data. Exempting free tools from privacy and contractual review fails by creating a dangerous loophole vendors can exploit. Requiring data-processing agreements only for paid enterprise suites fails because processing risk follows data flows, not invoice amounts. Reviewing plugins only after a public breach is reported fails as reactive governance that abandons prevention. Exam caveat: third-party and processor review is price-agnostic—watch for the free-tool trap on exams. Operational check: inventory browser and site plugins, route new ones through privacy and legal review before enablement, and confirm a data-processing agreement or equivalent terms exist where personal data flows. Block unsanctioned civic analytics add-ons until review completes so resident telemetry is not silently exported. Keep verification evidence with the municipal runbook so audits can prove the chosen control was applied as designed and that rejected alternatives would have left city services exposed to the failure modes described above.