Answered
August 24, 2009 05:58.
Especially for a not-for-profit or community based site, you may not need special Privacy counsel to develop a Privacy policy and operational Privacy practices.
The Federal Trade Commission has jurisdiction over many consumer-related Privacy issues and has excellent materials and guidance.. Check out
http://www.ftc.gov/privacy/privacyinitiatives/p....
In particular, you should examine the FTC's free guide for small businesses in this area:
Protecting Personal Information: A Guide for Business:
Practical tips for business on creating and implementing a plan for safeguarding personal information.
http://www.ftc.gov/infosecurity/
In general, a Privacy policy should be guided by the internationally recognized Privacy Principles, and adhere to practices which are consistent with them: The following example is an adaptation of the Principles developed for a public service entity:
• The privacy rights of individuals will be respected at all times and every individual will be treated honestly, fairly, and respectfully.
• Protecting individual privacy and safeguarding confidential information are a public trust.
• No information about an individual will be requested, collected or used without their express consent, or that is not necessary and relevant to our self-declared operations..
• Information will be collected, to the greatest extent practicable, directly from the individual to whom it relates.
• Information about individuals collected from third parties will be verified to the greatest extent practicable with the individuals themselves.
• Personally identifiable information will be used only for the purpose for which it was collected
• Personally identifiable information will be disposed of at the end of the retention period disclosed to the subject or required by law.
• Individual information will be kept confidential and will not be discussed with, nor disclosed to, any person within or outside of our business without the express consent of the subject..
• Unauthorized access to individual information by associates or employees constitutes a serious breach of the confidentiality of that information and will not be tolerated.
• Requirements governing the accuracy, reliability, completeness, and timeliness of individual information will ensure fair treatment of all individuals.