Each public entity that has a publicly accessible site on the Internet associated with it shall develop a policy regarding its practices relating to personal information and shall post notice of those practices on its publicly accessible site on the Internet. The policy must include:
1. Information collected. A description of the personal information collected on the publicly accessible site on the Internet;
2. Use and disclosure of information. A summary of how the personal information is used by the public entity and the circumstances under which it may be disclosed to others;
3. Choice. The extent to which the user has a choice of whether to provide personal information via the publicly accessible site on the Internet and the consequences of refusing to give that information;
4. Procedures for access and correction. The procedures, if any, by which the user may request access to that user's personal information and request correction of that information; and
5. Security. The steps taken to protect personal information from misuse or unauthorized access.