>Essentially, if you hold personal data, you have to give a copy of that to the person. I actually think that's a really good idea, and customers ought to dema

>Essentially, if you hold personal data, you have to give a copy of that to the person. I actually think that's a really good idea, and customers ought to demand that be added to privacy policies. Really, I think it's a reasonable law; some sort of "corporate freedom of information act" - If I ask you what data you have on me, you are legally required to respond and to tell me what data you have on me. Now, uh, for me? it would impose some costs (I mean, that's why my privacy policy doesn't include that clause. It'd be work to setup that portal, and liability, too... I mean, what if I miss some personal data? And besides, not one customer has asked for such a portal. Doing work that you /think/ customers want, without any actual customers demanding it? well, let's just say that it only happens after I get all the work that I /know/ I need to do done.) but, I think those costs are reasonable, and maybe even good (for society) 'cause it would cause me (or any service provider) to think long and hard about just how much data they were collecting, and it would add some cost to keeping old data around. Now, those costs would be different, I believe, for advertising-based businesses, as they may claim to 'anonymize' their data... but we've seen over and over again that anonymized data really is not anonymized at all. But yeah, working that part out would be the hard part of writing the law. If the data is easily connected to a real identity, then yeah, you'd want that real identity to be able to get the data... but how do you tell the difference between stuff that really is fairly anonymous, and stuff that isn't? you need someone smarter than me to write that test. But still... if customers immediately started demanding that the privacy policies of service providers included a 'privacy portal' where they could log in and view all the data that the provider has about them? that is really pretty doable. It's work, sure, and it's not going to happen without customer demand, but it's not an impossible amount of work.