> First, the right to have personal data minimized. Companies should challenge themselves to strip identifying information from customer data or avoid collecting it in the first place. Second, the right to knowledge—to know what data is being collected and why. Third, the right to access. Companies should make it easy for you to access, correct and delete your personal data. And fourth, the right to data security, without which trust is impossible.

This all sounds nice, but it requires a large level of trust in the companies doing as they say. How do we verify that certain data isn't being collected, that the data I delete is actually forever deleted, and that security standards are up to snuff? The FTC, as he suggests? Now the level of trust shifts to the FTC. How has their track record been? And the consequences of breaking the law, what would they be? As it is, companies engaged in shady practices seem to get less than a slap on the wrist.

Well, not to sound too dour, it is at least sounds like a step in the right direction.