The European Commission seems content to tinker at the edges, for example proposing mandatory data breach notification requirements but only for telecoms companies.

If the initiative is not taken by legislators soon, they will find Google superimpose its will on them, as is happening with their book settlement.

I get the distinct impression that all this data protection/privacy stuff has to come to a head soon.

Even leaving aside Italy’s recent sojourn into criminalising youtube videos on privacy grounds (I’m still vague as to their legal basis for doing this) the law in this area is an utter mess, and this is going to cause more and more problems. Data, particularly personal data, is an immensely valuable commodity, and, from a look at the recent management literature it looks like total personalization is supposed to be the next ‘big thing’, even in realspace business.

Yet we’re still basically using a monumentally opaque regime, based on vague ideas like ‘proportionality’ and ‘necessity’, deriving from a French law from the early 70′s, that was essentially designed to cover things like lists of addresses for marketing purposes.