Agreed - in fact, in the UK the Data Protection Act makes this a legal requirement (not that Google have to abide by UK law). You could change it such that user

Agreed - in fact, in the UK the Data Protection Act makes this a legal requirement (not that Google have to abide by UK law). You could change it such that users can only see the individual pics they're tagged in, and not all pics in the parent album. That may be preferable, but makes the situation more complex and means you can't see the picture you were tagged in in context. As you say, communicating how the security works is likely a better approach than changing the security model.