A Checklist of Responsible Information-Handling Practices.

Many privacy abuses are the result of errors and carelessness by those who handle personal information. Some are caused by inadequate security. Responsible information-handling practices begin with the development of privacy policies in the workplace and the implementation of regular training programs.

This checklist provides an overview of key points to consider when preparing information-handling policies and conducting privacy audits within your organization. The checklist can be used by private, public and not-for-profit organizations alike. Not all points will be relevant to your organization. Some situations may require you to take more stringent steps than those listed here.

The checklist is divided into two sections. Section I lists the major issues to consider when drafting privacy principles to safeguard the personal information of your clients, users, members, customers and so on. Section II includes considerations for the development of intra-organizational privacy policies concerning employee records, electronic monitoring and electronic mail. The citation numbers indicate references at the end of the checklist, e.g. (1)

I. DEVELOPMENT OF PRIVACY POLICIES TO GUIDE CUSTOMER/CLIENT RELATIONS

A. Organizational Policies

1. Does your organization, company, or agency have policies which outline its privacy practices and expectations for handling the personal information of your clients, customers, users, members and/or listees? [(8)(10)(13)] 2. Are your organization's privacy policies communicated regularly--in employees' initial training sessions, in regular organization-wide training programs, in employee handbooks, on posters and posted signs, on company intranet and Internet web sites, in brochures available to clients? Are all employees who handle personal information included in the training programs, including temporary employees, back up personnel and contract staff?

B. Privacy Principles