What Is A Fair Privacy Policy?

nlh asks: "I'm one of the founders of TruExchange, a small software company in the Boston area. We've just closed a major round of funding and are going through some VC-inspired (ok, VC-mandated) changes and maturations. One of these is the creation of a formal Employee Handbook, which will contain the all-important company Privacy Policy, among other things. The other founders and I are in the fortunate positions of being active Slashdot readers and of having a good deal of say in the creation of these policies. I wanted to get a feel from the Slashdot community about the best way to implement them (before it's too late)."

"From the employee's position, it's easy to scoff at the fascist-sounding stuff we read on here regularly ('We can and will see and hear everything you do when and if we want to.') but as a 'responsible' member of the management team, I have to take into consideration the legal ramifications of NOT reserving such rights. If we think someone is keeping a gun in his desk, we want to be able to check it. If someone is harassing people from our email system, we want to be able to verify it. What I don't want, however, is the creation of a police state (be it on paper or otherwise).

I'd like to come up with a healthy compromise -- We want to create a policy that shows our 'user friendliness', yet we must please the big VCs and protect ourselves as a corporation. We want to say 'We respect your privacy and will make every effort not to monitor you, but we reserve the right to do so.' Is such a compromise possible? What should a reasonable privacy policy say (and how should it be said?) Where does the line between 'employer covering its ass' and 'fascist bastards' get drawn?"