Yes. Here's the epic.org link shared in another Facebook thread here on HN yesterday by another HN participant:

http://epic.org/privacy/profiling/

That grocery store cannot then tie it to not only who you are but who your friends are. They have your name and address, but they don't have your entire social graph at their fingertips. Or your entire digital (or, with the rfid, real-world) historical travel data.

If this goes tits up, it could be just the kind of surveillance needed for a 21st century locked-down police state.

I still don't understand why people are so worried about grocery store discount cards. Ok, so they know my address. That's alright by me; my address exists so everyone can know it. So they know my name correlates to my address; that's alright too, they can find this info in public records.

The only possibly sketchy thing is they can correlate my food purchases to me and my address. However, this doesn't bother me personally. I don't care if the world knows I buy one kind of bread instead of another, or that I buy hummus instead of butter. If there are sensitive things you are paranoid about, like personal care products, just don't use the card for those purchases.

Either way, they just wind up with spending patterns on food correlated to one individual. The horror. It's not your SSN or passport or any of that jazz. Besides, if advertising became more accurately targeted, I feel that would generally be a good thing. You'd get in touch with products you were genuinely interested in, advertising costs would plummet (causing prices to drop as well), and there'd be less utterly useless cruft in the ads you receive.

There was an instance of someone being arrested because he purchased rope from a Safeway around the time that his wife disappeared. The police were able to obtain the guy's details from his Safeway card and used his purchasing habits to try and make him the prime suspect in the investigation. I think that it turned out that he wasn't guilty of anything either.

[ This is all IIRC, btw. My memory could be waaay off, but it paints a picture of something is not that far-fetched from possibly being the truth in a 'it could happen to you' sort of way. ]

I'll give you an upvote if you can find the source for that story. I can't find it myself.

http://yro.slashdot.org/article.pl?sid=05/01/29/030223

I had a leg up b/c I remembered that my source was slashdot.

The important part:

  a major piece of evidence used against Lyons in his
  arrest was the record of his supermarket purchases
  that he made with his Safeway Club Card. Police 
  investigators had discovered that his Club Card was
  used to buy fire starters of the same type used in
  the arson attempt. For Lyons, the story did have a
  happy ending. All charges were dropped against him in
  January 2005 because another person stepped forward
  saying he or she set the fire and not Lyons.

So I was wrong, and it was arson, not murder, but the point remains that the police were willing to use purchasing habits/items as circumstantial evidence to go after the wrong person.

> the police were willing to use purchasing habits/items as circumstantial evidence to go after the wrong person.

Hopefully it is not a great leap in logic to see that the justice system was what went wrong, not the club card thing.

The problem is that you assume your thoughts on justice worldwide.

China may have a totally different understanding on what is allowed and what not. The whole privacy data thing doesn't worry me very much in my country. But it's scary when i think of other countries.

The best way to put it is that large quantities of data by themselves are not evil and can do no harm. It's how people use them that matters. Once these large data stores are created it is impossible to anticipate all of the bad ways that people will use the data. It's disingenuous to claim that just because the data has never been used in a certain way that it never will be used in that way in the future.

It's the same as claiming that your privacy is safe because the company has a 'privacy policy' in place. In reality, the privacy policy say that it can change at any time and that the company has no legal obligation to notify you of these changes. These policies may change due to a change in direction at the company, or because the company is losing money and decides to sell that information to the highest bidder to stay afloat... Maybe the company is even swallowed by a larger company that then revokes all of the old privacy policies...

On the cynical side, the system cannot be fixed, so it is better to avoid the 'club card thing' so as not to give ammunition to those who would wield it against you.

I have a recollection of hearing about a "breakthrough" in the health insurance world when some company figured out that there was a substantial correlation between grocery items purchased and health issues. I'm very weak on the details (I think the context of my learning about this was a presentation of a "brilliant executive" who will now share blah blah blah-- oh, by the way, she figured out how to do this for insurance companies). My google-fu is weak, but here is a link that at least makes my fuzzy recollection a little plausible.

http://www.seattlepi.com/local/70072_loyal11.asp

This is a pretty serious outcome IMHO.

Edit: HBR article http://download.microsoft.com/download/7/d/5/7d50c016-6e60-4...

Frankly I don't blame insurance companies for looking at as much info about you as they can. The only way they can improve business is by more accurately predicting incidents, which is done by examining more metrics and making better models.

Nobody has a problem with this when it comes to auto insurance; you have a lot of tickets, you get high rates. You have too many tickets, they won't insure you. Why is it so different to give higher rates or refuse coverage to someone who treats their body like crap, when their body is what's being insured?

Sorry I'm so late in replying to your comment. The issue here is how the insurance companies obtain that information. I think the analogy would be if auto insurance companies determined their rates using data from your cell phone provider as to how fast and where you drive. And, especially, if they were to do so without your knowledge.

>if advertising became more accurately targeted...You'd get in touch with products you were genuinely interested in... there'd be less utterly useless cruft in the ads you receive.

Counter-example: facebook.com. Supposedly that site has a lot of info on their users, yet their "targetted" ads are as useless and cruft filled as ever.

I wouldn't be worried about the grocery store having access to that data. I would be scared of who they might allow to access it. Ever wonder how collections agencies find out what your address is when you move?