that a Privacy Policy is needed because everything needs a policy today. (Well, not literally everything, but having more is often better from a legal protection standpoint.) An organization has to enforce its policies, not just have them, but not having them can make consistent enforcement even harder. I would welcome replies or thoughts on what a privacy policy can and should cover to be sufficient and not overbearing