And I entirely agree about the problems with harmonisation of privacy laws – after all, I just came from another briefing about the ACTA treaty where international harmonisation is causing problems!

It’s already implicit in the Privacy Act, but the idea is that if you aggregate public data about someone you are effectively creating personal information (converting data into information) and therefore the Privacy Act principles should apply to it.

As for Google vs the government – I worry about both, but in some ways I’m even more worried about the third party who aggregates information from multiple sources including Google, Twitter, publicly available data and ties it together to infringe my privacy.

One obvious example is the one in the article, where people can collect geotagged information from multiple sources and then use it to track your movements – and post that to the web. I’d see that as an unwarranted invasion of privacy.

Maybe we can’t put the genie back in the box, and people will have to accept that they *will* know stuff about each other, and with that comes a higher requirement of tolerance.

I’d also suggest that “international harmonisation” of proscriptive laws could easily end up with us having a restrictive legal framework we can’t change democratically (a bit like drug and copyright law). What if I *want* to use a service that aggregates data from multiple sources – do I need people’s permission to have their face pop up on my Android when they text me?

I’d be wary of replacing the problem of corporate invasion of privacy with another one – a further are of net censorship.

Aggregation of data is also a way of turning anonymised data into much more precise information about people. This means while, for example, you might be happy with a company releasing anonymised data about your activities, because you can’t be readily identified from solely that release, if you patch together enough of those sources you can end up with a highly accurate and specific set of information about you.

For example, your MAC address does not identify you personally as-is. Gathered from, say, wireless broadcasts, we can assert where that MAC address is, your address. But your MAC address is also used as the basis of IPv6 addresses, attached to cookies, and then to your login on a website. Now armed with anonymous wifi data I can assert your location even if you have never provided it to me or given me that right.

“Aggregating from multiple sources”: a company would then be banned from combining data from their customer mailing list with information from the phone book? Hmmm.