At the very least, at a bare minimum, I think we need legislation that covers how this kind of data processing happens by third-party companies and we need to provide a way for citizens to at least see what data has been collected about them and what 'insights' it has generated.
Even now, the problem is that you want the data sometimes. Like maybe you use Life360 because it's handy for your family. Well, it knows how fast you drive (it likes to tell me my wife's top speed after she goes somewhere...). It has enough accelerometer access to decide if you've been in a wreck. It's a GPS app so of course it has pretty tight location information. And maybe you consent to all this, but hidden somewhere in the TOS it says Life360 may share this info with selected partner companies. Now it gets slurped up by big data warehouses.
Maybe you install a sleep tracking app. Now they know how well you sleep, and I would bet they could pretty accurately figure out if/when you're having sex. Depending on the device, they might even be able to guess whether or not it was solo.
Perhaps you don't like the limited options Apple has for pedometer data, so you install Pedometer++. Another possible avenue for data collection.
Or Instacart, Uber, Uber Eats, etc.
So. Much. Data.
No need to hide it, Life360 clearly states right near the top of its privacy policy "In order to keep our Service free for most users, we generate revenue through trusted data partnerships. We share device data, including location and movement data, with trusted data Partners for tailored advertising"
When your Apple device communicates with "Apple", many/most of those IP addresses are owned by Akamai.
Even when you search DuckDuckGo, both the search results (Bing) and web servers that serve the content are owned by Microsoft (Azure).
So far as their businesses are concerned, the data is safeguarded and I would never expect it to be sold--not by the top of the data food chain in any case.
But there's the issue of data being stored with US companies requiring being subject to US laws, such as the USA PATRIOT Act.
TLS SNI.
"Gmail messages 'read by human third parties'" https://www.bbc.com/news/technology-44699263
"One company told the Wall Street Journal that the practice was "common" and a "dirty secret". ...Google indicated that the practice was not against its policies."
If the information is stored on servers in China, then the Chinese government has it as well. Maybe you aren't a Chinese citizen so you don't care, but it's at least worth considering.
The politicians we elect to craft and enact legislation that affects the big data companies are always at risk of being essentially blackmailed by those companies with the incredibly detailed and personal information that those companies have on politicians.
Notable examples:
* Strava revealed the position of US military bases
* Muslim prayer apps sharing location data with US military
In my own experience, I work for a call center. We have many important American companies as clients. They give us access to their systems so that we can service their clients. I am overseas dealing with their customers and I can access their personal information. I can see their face linked to their Facebook profile. I admit I've been tempted to misuse the information any time a customer makes me angry.
I personally think that if I give this data to a company, and they keep it "safe" and only to support features that are beneficial to me, that's totally OK, but I wouldn't like companies reselling my mobility data to health insurers (without aggregation or cohorting) to give me a 100% customized insurance rate, regardless of how beneficial that would be.
Data that's used to distill people down to a number and value them precisely seems to have a potential to enforce systematic inequalities and further improve the lives of "haves" at the cost of "have nots".
Anti competitive behavior, I would think comes automatically with such massive centralisation. What's scary is the ability to mass incite riots, using knowledge of the most susceptible audience to fake news and pushing it out incendiary posts to exactly that audience. India has faced multiple such incidents already. Deliberate ? Maybe in the sense of affinity algorithms.
With the backdrop of the Stanford experiment, and a host of other biases giving almost tribal warrior behavior, should such affinity data be allowed for collection ?
My apologies if this sounds drastic, but data collection generates micro nukes, generated based on turning individuals into an array of microcrucibles.
https://www.opendemocracy.net/en/largest-personal-data-leaka...
Venture capitalist Peter Sims wrote about being tracked in a blog post this September. Back in 2011, he wrote, he was in an Uber car in Manhattan when he started receiving text messages from someone he barely knew telling him exactly where he was. That person later told him that she was at an Uber launch party in Chicago, where Sims' movements were being tracked via God View on a large public screen.
https://www.buzzfeednews.com/article/johanabhuiyan/uber-is-i...
https://www.theverge.com/2016/1/6/10726004/uber-god-mode-set...
https://www.vice.com/en/article/ypw5n7/ubers-god-view-was-on...
Use a list like this as a starting point.
https://www.oag.ca.gov/data-brokers
Commuter data is good, so is foot traffic. Data sets centered around health and income or quality of life can be beneficial as well. The game is to use publicly available information about your person to tie them conclusively to set of entries in an 'anonymized' data set.
If you aren't at least investigative journalist tier or the resources you need cost too much/require a corporate presence, then hire someone to do it for you who already has the pipeline set up. PI's have been available to Joe Q. for years and they still are. This all just makes them even more efficient.
I'd argue that it doesn't need to be "Joe Q. Public", because companies are made up of Joe Q. Publics.
Or, in lieu of that, walk me through how that would be done with Facebook's, Google's, or Apple's data via your first-hand knowledge of those data and where and how they are stored and accessed?
These fear mongering comments about data collection have never demonstrated real world harms, AFAIK. It reminds me of the genetically engineered foods bogeyman that, in spite of a complete lack of empirical evidence, continues to be trotted out as a huge danger.