"You have no expectation of privacy when in public."

I'm seeing this objection a lot lately, and perhaps I'm showing my age here, but I've certainly got an "expectation of being largely individually anonymous when in public". While there's nothing to stop people looking for me and possibly finding me in public - I _don't_ expect people(/corporations/tlagencies) to be recording everybody in public spaces and archiving them permanently in ways that allow all archived recordings of me to eventually be crossreferenced and de-anonymised.

These days though, the technology exists to do just that - and people/companies/agencies are doing it on smaller or larger scales, without societies discussion or approval, and without the laws regarding that collection being brought up-to-date regarding the citizenry's wishes.

The genie is probably a long way out of he bottle now, face detection, face recognition, ubiquitous cellphones with their wifi, bluetooth, and GSM/CDMA transmitters - we are all, in a lot of circumstances, uniquely identifiable in crowds - and probably a startlingly large amount of the time, fairly trivially trackable across spaces till we get to places where things like credit card transactions can tie all recorded surveillance back to our legal identities.

But acknowledging that all that's _possible_, doesn't mean we need to accept that it's open season on personal tracking data. Your health care providers are under heavy regulation about what data they're permitted to collect and the standards they're required to secure that data too(HIPPA, in the US). Anybody collecting credit card payments needs to comply with the PCI standards.

Instead of saying "you have no expectation of privacy in public … ", shouldn't we at least consider having the discussion about "now that ubiquitous surveillance is technically possible, what are the community expectations of privacy in public, and should we choose to regulate the collection, storage, and use of personal data collected in public spaces?"

Times change. Peoples opinions and expectations change. Laws change - slower than public opinion, but they _eventually_ catch up (hopefully with the right "lag" to avoid fashion/fad law changes, but quickly enough to stop people revolting against law enforcement and the legal system).

Speeding used to be "legal", back before we passed laws recognizing the "danger to society" these new-fangled horseless carriages represent. Cocaine, ecstacy, and LSD were all once unregulated and "legal". It used to be OK to take pocketknives and drinks on airplanes. It used to be against the law to export strong crypto from the US. It used to be legal to own slaves.

I'm not suggesting society or the law have settled on ideal solutions or reactions to those examples - but I am suggesting it's time to at least start talking about whether there is a difference between a "shopping researcher following someone around a mall", and an automated system tracking and recording everything every visitor to a mall does - and tying that back to "unique identifiers" (phone's wifi/bluetooth MACs, face recognition, cc details at cash registers), then being able to track that all across multiple visits or visits across multiple locations.

Personally, I'm of the opinion that "public space personally identifiable data collection" should be regulated similarly to HIPPA. There needs to be accountability, transparency, up-front notification, and ability for an individual to opt out without suffering any repercussions. I think shopping mall operators should be asking them selves serious questions about whether their ongoing responsibility to secure any personally identifying data (camera feeds, facial recognition output, skeletal geometrics, personal electronics identifiers, etc) - and the legal penalties they'd be responsible for if that data ever gets misused or exposed - is worth the benefit of collecting and storing it in the first place. I think police departments and towtruck/repo cpllectives doing widespread ANPR should all be shitting themselves at the legal/financial consequences of their databases of time/location of individual's vehicles being stolen, and ensuring they've got auditable/provable policies in place to minimise the storage of that data to very short timeframes to demonstrate "reasonable care" of people's privacy in any future court cases.

I might be wrong - and perhaps most of society thinks that's all unnecessary government regulation (and hell, I'm perhaps hypocritically all for "small government" and fewer rather than more laws) - but I'm pretty sure nobody has actually _asked_ "the public" whether it's OK with them while explaining what "it" is and the consequences (either positive or negative) to them. I'd at least like that discussion to happen.