Seems like a law & privacy question that has no relation to technical security. Input & discussion? Trying to get an idea of our consensus on non-tech privacy law
I would say it's in the grayish borderline area.
Privacy, per se, is definitely within the purview of this site, and is absolutely on topic.
Technical solutions (and non-technical policies and procedures) to ensure compliance with, or avoidance of, legal issues - also on topic.
However, in this specific question, it seems the root of the question is inquiring as to the legal implications of a specific, lawyer-ish policy document - which actually might be seen as a contract of sorts.
I think the question could be broken down to 2 components - the lawyer-y, contractual, legal implications side of things, which should go to Legal.SE (if/when that goes live/public), and the more principle-y, privacy-ensuring side of things - e.g. how do I protect my privacy, or what privacy should my site offer.
Btw, judging from some of the answers, OnStartups might also have what to say :)
It's a legal question, not an IT security question.
Questions like this should be migrated to the Laws & Legal Questions SE.
So, IMO the Laws & Legal Questions SE should be added to the options for "does not belong here" flags, as soon as that site goes into public beta.
This is a tough question to judge from a provider's viewpoint. As a security provider I know the risks of putting information on a public site like Facebook, but the vast majority of those people using public sites like Facebook do not understand the risks. I think that IT Security should provide qualified advice to individuals about IT security where it may make a positive impact.
If we can help common Facebook users instead of just privacy savvy Facebook users we have the potential to help many people.
However, in this case the legal part of the question is not relevant. I think we should seek to answers questions like this by severing the legal part of the question either through editing or response. For example give answers that declare ignorance on the law but assume that Facebook can legally sell/give personal information and then suggest practices or mitigations.