One very important best practice in privacy is to be transparent regarding what information is collected, for what purposes it is used and shared, how it is protected and what control if any individuals have. See Penn’s Guidance on Website Privacy Statements and Penn’s FERPA Notice for example.