I personally don't believe that privacy policies are useful at all. They are at best the web equivalent of a verbal agreement.
People need to adopt the security-oriented attitude that says, if you post anything, anywhere, the entire Internet may very well see it. Period. You cannot trust every server, protection mechanism and employee in between. (You wouldn't really know who to sue, anyway.)
If something really "must" be private or controlled, then you don't need a policy, you need actual control over your data. For example, don't post the thing on an Internet-enabled computer in the first place. Or, strongly encrypt it, and have absolute trust in the recipients of keys. If you've made your key recipients sign something legally binding, and retained proof that no one else could have received keys from you, then at least you'd know who to sue for violating your trust.
Ideally, the mechanism for transferring the keys doesn't use a network either, e.g. physically hand something to your intended audience that will let them decrypt whatever you do send. The data should also have a built-in "time bomb" that makes it impossible to decrypt anything after some specified period of time (for peace of mind). Of course, the recipient could do something stupid like save the decrypted data somewhere, which is why the legal binding to key recipients is so important.