ARCHIVED: Completed project: Website privacy notice policy

Primary UITS contact: Eric Cosens

Completed: January 4, 2011

Description: A website privacy notice (or privacy statement) is a public description of an organization's information management practices with respect to information collected by the organization's website. Such notices have two purposes: visitor education and institutional accountability.

Outcome: This policy will outline Indiana University's philosophy concerning the use of website privacy notices, and give limited guidance to website content owners and site managers in the development of their own privacy notices.

An accompanying privacy notice generator tool will be developed to assist content owners and managers in drafting model text that matches their information practices.

Milestones and status:

• Drafting/developing policy language Completed 2008
• First formal stakeholder review/comment period Completed Fall 2009
• Currently incorporating feedback into revised draft Completed Spring 2009
• Developing privacy notice generator Completed Spring 2009
• Second formal stakeholder review/comment period on policy draft and prototype privacy notice generator Completed Spring 2010
• Privacy notice generator tool beta testing and enhancements Completed October/November 2010
• Policy approved January 4, 2011

Comment process: Policy draft can be viewed at Web Site Privacy Notices (ISPP-24).

To send comments or feedback, contact Eric Cosens.

Benefits: Notification of privacy practices is a basic principle of good information management, and builds website visitor confidence.

Furthermore, the process of creating and maintaining a privacy notice requires website content owners and site managers to understand their information handling practices and may reveal potential issues to be addressed.

Project team:

• Thomas Atkinson
• Nathan Byrer
• Eric Cosens
• Stephen Hodges
• Kathleen Horvath
• Merri Beth Lavagnino
• Craig Spanburg
• Scott Wilson