Many of these discussions happened in the 1970s as people first became aware that large databases (then often called "databanks") were being built to store lots of personal information, and that information from one database could be combined with information from another via a database join. That raised the specter that information originally collected for one purpose could come to be used for a very different purpose.

An important result of those discussions at the time was the Fair Information Practices

https://en.wikipedia.org/wiki/FTC_Fair_Information_Practice#...

which came out of two U.S. government studies on privacy during the 1970s.

These principles include things that are quite similar to what this article proposes, including notice (of what's being collected), choice (about whether it should be collected), and access (to know what others know about you).

The Fair Information Practices formed the basis for European data protection legislation, which has now been implemented in some form everywhere in Europe as a result of the EU Data Protection Directive and other legal instruments. (Of course the Europeans reformulated it and did not directly enact the original U.S. Fair Information Practices into law.) An interesting consequence of that is that most Europeans, at least in theory, have quite extensive rights against information collection that violates these rules (at least by the private sector).

Many Europeans have been able to exercise these rights in practice to challenge data collection and retention by private companies, to see what the companies know about them, or to demand that companies delete information about them. Some of those examples have been mentioned here on Hacker News; the one that I found the most interesting was when Malte Spitz got his cell phone location records from Deutsche Telekom by exercising his right of access under German data protection law.

http://zeit.de/digital/datenschutz/2011-03/data-protection-m...

Anyway, I think these rights are quite similar to what this article is proposing, so I wanted to point out that there is a long history of similar proposals, and that the idea that technology was taking away people's practical right to control over data about them is something that's been a concern for some decades.

By the way, the United States never enacted a comprehensive data protection law, despite being where the Fair Information Practices were first cooked up. They were never given the force of law in a general way, as they were in Europe; here in the U.S. companies can, in general, collect and use data in ways that would be considered "unfair" elsewhere. The main consideration in the U.S. is that the companies can't lie in their privacy policies, but there are few substantive restrictions on the private use and disclosure of data, outside of particular regulated sectors (like credit cards with FCRA, health care with HIPPA, and education with FERPA). There is extremely strong industry opposition to a generally-applicable data protection law here.

Some sore points about data protection where it did get implemented into law:

① European data protection law is leading to some weird and counterintuitive results, recently including the Google v. AEPD/González case where Google was ordered to remove links to old disparaging (but accurate) information about individuals when users search for their names, based on the idea that Google was "processing" personal data about those individuals in an inappropriate way.

② Data protection often has major loopholes for government collection of information. (Government agencies, including police and spy agencies, very often are subject to privacy and data protection laws, but the application of those laws often means just that those agencies are supposed to deliberate about whether they think what they are doing is OK; if so, they can carry on.)

③ As this article and this discussion seem to suggest, notice and consent have become more difficult where companies expect to use large amounts of personal data routinely. The amount of consenting that users would be asked to do and the frequency with which they are asked to do it could become quite annoying and also decrease the likelihood that users will take the time to understand what they are being asked to consent to. (We can see this to some extent with the cookie notices on European web sites, asking users to consent to being tracked by cookies. Contrary to the mainstream view of web developers, I think cookie tracking is a serious privacy risk that users should still worry about in 2014 and that addressing this risk is pretty important. But we can see that the warnings haven't necessarily made most users better-informed or more cautious about cookie tracking, and many users are probably kind of annoyed that every site they use is warning them about cookies.)

As a result of the last point, I heard a Microsoft executive in a speech say that he thought notice and consent were now obsolete and ought to be rethought. (This statement isn't super-shocking to Americans, who might not even have heard about Fair Information Practices in the first place, but it could have been something of a scandal if he had said it in Europe.)

The executive gave the example of the number of different entities that are receiving user information when a user interacts with a major web site, and the number of different privacy policies that would be applicable to these interactions. He suggested that few users would even read the policy of the site that they're trying to visit, let alone the policies of third parties (that might receive user data as a result of embeds or as a result of business partnerships).

I thought that preventing and discouraging some of those data flows was actually a goal of privacy protection. In fact, a lot of privacy software, including software recently developed by my colleagues, is actively trying to stop them, based on the idea that users don't know about them and that they aren't in the user's interest.

https://www.eff.org/privacybadger