(a) Each agency that maintains a state agency website shall develop a policy in conformity with the provisions of this subchapter. Each such policy shall include, but not be limited to, the following elements:
(1) A statement of any information, including personal information, the state agency website may collect with respect to the user and the use of the information;
(2) The circumstances under which information, including personal information, collected may be disclosed;
(3) Whether any information collected will be retained by the state agency, and, if so, the period of time that such information will be retained;
(4) The procedures by which a user may gain access to the collected information pertaining to that user;
(5) The means by which information is collected and whether such collection occurs actively or passively; and
(6) Whether the collection of information is voluntary or required, and the consequences, if any, of a refusal to provide the required information.
(b) The Department shall develop a model website privacy policy that can be utilized by state agencies to comply with this section. State agencies may modify or depart from this model policy, provided that the requirements of this subchapter are met.