I'm not sure the distinction is as clear, or as relevant, as you imply. At what level are 'business transactions' defined? Is there a separate transaction with

I'm not sure the distinction is as clear, or as relevant, as you imply. At what level are 'business transactions' defined? Is there a separate transaction with your ISP for every packet you send or receive? I would have thought that the relevant business transaction occurred once per month, when I paid them $X to carry Y GB of data on my behalf (and similarly with phone companies). Anything more granular than that is an implementation detail of the service: sure, the ISP has the ability to observe and log the full header+data contents of any packets I send, and might even have good business reasons to do so, but it doesn't follow (to me at least) that every packet I send through this connection is now a business transaction record over which I have no reasonable claim to privacy. It's clear that there are some forms of metadata (call records, packet destinations, etc) that are useful and perhaps necessary for service providers to observe and log, in the course of providing their services. But insofar as the privacy implications of releasing that data fall almost entirely on consumers, not on the service provider, it makes sense to give consumers some say over what happens to it. In this view, metadata really is "my data" in the sense that a service provider should have an obligation to protect it, analogous to medical records (which are records of 'business transactions' with my doctor that they nonetheless have an obligation to protect) or documents provided to an attorney under attorney-client privilege.