What they had
- A privacy policy that names no responsible person, on a site that must name one
- An incident register that exists as an inbox folder
- One estate either side of the Ontario border under a single policy
- A French site that was translated once and never again