Guidelines for Developing a Privacy Policy

There is some risk of disclosing identities of individuals (or entities) and their sensitive data that exists in every data file that is released. A privacy policy should describe a process that considers whether the release of the data file followed reasonable procedures and a process that applies appropriate data use restrictions and access controls. At the very least, the risk of re- identification should be minimized after considering the possible approaches to re-identify persons using existing technology and public or commercially available information. Furthermore, it is important to be aware that the privacy of individuals can be impacted by a data release whether or not the person is in the file