It's crazy, almost like people don't trust corporations to be reasonable when they have such vague abuses of the law to escape into. Maybe we shouldn't have to trust corporations not to spy on us in spaces that carry reasonable expectations of privacy. Maybe we should regulate their greedy data-grubbing into the ground so we don't even have to speculate, and so the miserable people who work at these corporations are stymied from even attempting it. What a splendid utopian ideal.

I work in privacy, too - mine.

I hope you’re just trolling, I’ll bite.

Privacy is not about what someone _might_ do with your data, it’s what they _can_ do with your data.

It’s also that they have your data, which means it can be exposed to staff or the world as the result of a breach.

Disagree on first statement. It's what they do with it that matters, not what the contract says.

On the second point, sure, but so we have knowledge of what, how, and for how long, the carmakers are storing?

Would you sign a paper saying I can come into your house unannounced if I suspect you stole something? If you do not steal you have nothing to worry about

> It's what they do with it that matters, not what the contract says.

What they do with the data changes based on leadership (should we sell to 3rd party data brokers to increase our revenue or not?)

It’s also out of their hands once a subpoena for that data comes from law enforcement.

With respect, I believe that both things are important.

It's important to know what they do with that data today.

It's also important to know what they could do with that data tomorrow.

I respectfully disagree with your initial point regarding "can" versus "what they do."

Even if a company provides assurances and pledges never to mishandle your data or use it for nefarious purposes, there remains a risk that your data could still end up in the wrong hands.

We’re not the ones making these policies far too broad and open ended.

But that's the point of the privacy policy. Why would you have a privacy policy that says you can do a thing if you have no intention of ever doing it. It's plausible that the lawyers were instructed to capture as much as possible with the intention of worrying about what was actually wanted later, but that's precisely the point. Later, they could decide to do anything covered by the policy and there's not only no recourse but no way of knowing what they are doing. That's why you have to take the privacy policy at face value.