When using OpenID for logging into the system we pass personal data about the user between sites without telling the user that their information is being passed between sites.

I believe this is in direct contradiction with one of the first lines of our Privacy Policy:

What Personal Information Does UCAR Collect?

You can visit the UCAR Web site without identifying who you are, or revealing personally identifiable information. If you do provide personal information when signing up for a service, UCAR will not sell, trade, or give away your information.