Privacy regulation is hard. It involves making choices about the delicate balance between security and convenience that will be codified into law. But in the current technology and business environment there is no clear consensus about where those lines should be drawn, beyond obvious cases of misappropriation and abuse. What precisely constitutes personal information? What legal protections should be available to data collected from users, particularly abstracted or aggregated information? And in what contexts should those protections apply?
Informed people can disagree in good faith about these issues, and the stakes are high. The collection, use, and analysis of personal data is central to the business models of many services we rely on every day, including some of the most highly-valued companies in the world. Often those services are provided for free (or apparently free) because those companies are permitted to collect and commercialize our personal information in some form. Getting the balance wrong—especially in a legal or regulatory framework—comes with major implications.
