I wish politicians used that mantra, too, and made laws that basically split information into various classes or levels of sensitivity. Companies would still be free to collect whatever data they want. But the higher the sensitivity level, the punishment becomes progressively bigger, too, in case of a data breach that exposes that information (and the punishment should be almost automatic when it happens).

I believe that should give companies enough incentive to:

1) collect only the absolutely necessary data that they need

2) if they do collect more sensitive data, invest heavily in protecting it

I disagree. Cynical me thinks this plan would first and foremost give companies incentive to gain control about whichever agency is tasked with setting the sensitivity levels - and make sure all interesting data is classified as "minimum sensitive"...

You could even use this as a tool to gain an unfair market advantage:

1) develop some proprietary (reversable) obfuscation algorithm

2) market the algorithm as "data anonymization" and lobby to get the "anonymized" data classified as insensitive

3) you can now collect the same data as your competitors but have to obey lesser security standards than they have. Unless they purchase the algorithm from you.

4) profit!

But even if that scheme worked, it doesn't seem to protect the end user against things companies intentionally do with the data that are not in the user's interest. Including "intentional data breaches", aka selling the data to third parties. (or getting acquired by a third party)

"anonymized" is mostly a joke anyway. Seems more likely to indicate they removed your name and email than any attempt to prevent identifiability.

Cynical me says 95% of everything in this area is profit, to hell with anything else.

Aggregation and volume itself is dangerous.

My challenge to the Surveillance Business Sector (Google, Facebook, Apple, Amazon, banking, etc.) is to figure out how to offer services with minimal, or better, zero, user tracking. That's challenging, as even incidental signatures leave traces, but what's currently happening is, IMO, either untenable or leads to quite horrible things.

Consider: in a world in which any conceivable piece of information is available on a person, then any conceivable claim becomes credible. It's McCarthy's "binders" on steroids. Insinuation alone can be devastating.

On the matter of "collecting only the necessary data" for a given transaction, there's a post I tried submitting on Ello (oddly: specific content seems to break their submissions, they're aware of this) of my experience clicking on "log in via Google+" on TypePad.

For the service of authenticating to TypePad, I was expected to divluge:

1. All people in my Circles. Including non-public Circles.

2. My own demographics.

3. My email address.

4. Permission to "manage" my Google profile.

Under what Orwellian Hell would I provide access to my entire damned Google profile to some third party for the ability to post a comment on a blog?

Who possibly, at TypePad, or Google, possibly thought this was a good idea?

(I've got quite the rant written on this, waiting for Ello to fix their bug so I can post it.)

I'll take a guess that you believe real name, home address, and phone number are way up there on the "extremely sensitive" side.

Most of the American public remembers phone books. I don't think they're going to vote to make publishing the White Pages punishable by serious jail time.

It is (or was) difficult to process a phone book at the rate of 100,000 entries in a few minutes or seconds. Electronic data gives you that capability.

The information in a phone book is now the backing and access data, at least in some cases, to other online systems and services. "Who are you?" is the most expensive question in information technology. No matter how you get it wrong, you're fucked.

There are a great many systems which now can use the information in a phone book, or which starting from a phone book you can access, to commit fraud (it's called "identity theft", but it's still just plain old impersonation fraud). Unfortunately, this becomes, in many jurisdictions, the victim's problem.

It's not so much that phone books have changed (though that too), but the world around them certainly has.

Identity theft is possible for the sole reason that privacy advocates consistently defeat proposals to build any system of identification/authentication less broken than forgeable drivers licenses and shared-secret SSNs. People actually get angry when we make it harder to forge IDs! Propose any sort of PKI or .gov OAuth provider or something, and you're basically Big Brother himself. It's like the ability to commit identity theft is considered a right.

Trying to authenticate people by their knowledge of data that's in or easily deduced from the public record (or "shared secrets" shared with every entity they've ever done business with) is an objectively wrong security design and we need to stop using it. Making those public records harder to access is an absurdly circuitous fix to something other than the real problem.

This is pretty much exactly what European data protection law says. Although it doesn't put very much emphasis on protection against accidental disclosure, it's more intended against deliberate disclosure.