How might we ensure privacy statements meet requirements and our terms of use?

It is the client's responsibility to ensure that their form meets the requirements set out in our ToU, including having a complete privacy notice. However, how do we handle cases where a form doesn't meet our ToU?

For example - what (if anything) do we do when a form collects personal information but does not have a privacy notice?

ie. [this form](https://forms-formulaires.alpha.canada.ca/en/id/cll55a578005kx367csnd66gl) is missing a privacy notice (only has a link to the Privacy Act, which does not fulfill the requirement) and the personal information it's requesting is at least Pro A and possibly Pro B, depending on the info end-users provide.

From a technical perspective there is the requirement of a "privacy notice" for publishing but it only checks that there's something in the input -- that something could be a space

I'd be hesitant to introduce additional approvals because it could hold up the publishing step and is it our responsibility or role to check/police?
- Maybe there's something else we could do in instructional guidance?
- Also, any thoughts on making its placement flexible?

Would love to dig into and discuss what other options / solutions might be possible

**NEXT STEPS:** @samburtonCDS to draft initial analysis/ideas for discussion, and share with @anikbrazeau to decide if/how to move forward