> There is a fundamental difference between the government spying on citizens or abusing the information they collect, and companies doing so.

I respectfully disagree. It doesn't matter whether, for example, an identity thief obtains the personal information necessary to take over my life from a government database leak or from a private company. The consequences are just as damaging.

Moreover, I find no meaningful distinction between the power of government and the power of megacorps any more. The gap between the power of the individual and the power of the state/megacorp is so vast either way that either is a fundamental threat to quality of life if they screw up.

> People voluntarily sign onto Facebook every day, and the company does not violate its privacy policy (if it did, you'd have grounds for a law suit).

Well, firstly, I challenge your claim that they always operate within their privacy policy. For example, Facebook collected vast amounts of information about me without my knowledge or consent, because a huge part of their modus operandi is to get friends to contribute information about each other and develop their database via networking effects.

Secondly, I don't think their privacy policy really matters, because it's one of those legal cop-out things (if it even has any legal weight at all) that companies hide behind when they do something unreasonable. As we see in cases like the recent Buzz mess, there is a world of difference between what people might think they are agreeing to and what a company's lawyers think their privacy policy lets them get away with. This is a well-known legal problem, and indeed most jurisdictions have provisions in law specifically for cases where there is an agreement between two parties with disproportionate power to negotiate the terms.

In any case, these companies can and do vary their privacy policies on a whim. A privacy policy is a PR exercise, and little more. The big names have shown repeatedly that they cannot be trusted to safeguard sensitive information properly, and that they will push and if necessary break the boundaries of reasonable behaviour as much as they can get away with. People's privacy is too important to allow that kind of unregulated power, precisely because once lost it is difficult to ever regain.

Finally, the "you can raise a lawsuit" argument is pretty meaningless in a pay-your-own-fees jurisdiction. No individual is likely to receive sufficient compensation for any abuses even to cover the costs of bringing the case, unless there has been a serious event that follows a breach. The big companies know this, so they can happily go around risking everyone's privacy, and write off the costs of paying out compensation in any cases that do go to court as a mere business expense. This is not an effective deterrent, which is why I say we need company-destroying penalties for people who deliberately violate people's privacy or abuse their databases. Making it a criminal act and throwing the directors in jail is an acceptable alternative. Making them turn up in court as a formality and issuing a fine so puny that a first-line manager can pay it out of his expenses budget is not.

> It's not the government's place to institute laws to protect consumers from themselves.

Oh, I disagree. For one thing, I disagree with your characterisation of people as mere consumers. In many cases where databases are being built, the information is collected indirectly, not via a simple supplier/consumer relationship. And of course there are some services that are effectively essential, or indeed things you are legally required to have, and while you may be a consumer of such a service you don't get any choice to opt out (or your only choice is between providers with similarly dangerous policies regarding personal data).

In any case, I think it is the government's job to protect the little guy. It is one of the most fundamental and necessary requirements of any civilised government that it protect the individual against abuses by those more powerful than the individual alone can fight. Pretty much all law is based on this premise.

Of course people have to take reasonable responsibility for their own behaviour. I'm not disputing that, or saying that the government should clean up after someone who is grossly negligent or knowingly does something that will endanger themselves. But there is a difference between that and expecting an average person going about their daily life to fully comprehend all the legal subtleties and dangers in the world around them, which no-one on this planet can do completely.

> The proper action here is educating people about privacy, not adding more legislation.

I'm all for putting education ahead of legislation, and I absolutely agree that awareness about privacy issues needs to be raised.

But you have to have legislation to back things up. There's no point raising awareness if you don't provide an effective redress if megacorps violate the privacy policies that an educated user carefully read. There's no point expecting people to look after themselves if you're going to uphold a 20 page privacy policy written by a team of professional lawyers that would take a typical person several days and several thousand in legal fees to understand.

What is needed is a combination. By all means, make education the priority. But right now, there are abuses going on that affect even savvy users; it's not as if everyone who just got done over by Google's Buzz problems is a clueless person who should have known that by signing up to a completely unrelated Google service they were opting in to this.