Little Brother Is Watching, and Won't Stop

Chuck Schumer is on a rampage against OnStar. He's calling for an investigation into OnStar's actions after their announcement that they would continue to track former customers even after they canceled their subscriptions. From Wired:

OnStar began e-mailing customers Monday about its update to the privacy policy, which grants OnStar the right to sell that GPS-derived data in an anonymized format.

People are always so worried about government intrusion into their privacy, but the real threat is companies like OnStar. Nothing except their "privacy policy" actually stops them from selling non-anonymized data to your ex-wife's divorce lawyer.

In the United States, nothing really stops companies like Yahoo, Google or Microsoft from selling your query history, except the threat of angry customers. Facebook is about to start telling everyone you know about everything you do everywhere. How long before these companies decide to start monetizing this information? Many states already make millions of dollars selling drivers license information to insurance companies, companies screening job applicants and companies like LexisNexus and ChoicePoint Services, Inc.

ChoicePoint is a private espionage agency that become notorious when it erroneously scrubbed thousands of African-American voters from the voter rolls in Florida before the 2000 presidential election.

But it's worse than this. Pretty much any company you do business with has sensitive personal information on you, especially the banks issuing your credit cards. Law enforcement has to get a warrant to get this information, but what is really stopping the companies from selling the information to anyone who's willing to pay for it? They're supposed to tell you what they're doing in their privacy policies, but these can be written ambiguously and almost no one reads or understands those things. And even if they're not actively hawking it, how many thousands of employees at these credit card companies can browse your purchase history at their whim? How is access to this history controlled? Are these accesses logged, so they can track down employees who are getting this information on the sly and selling it to your ex-wife's lawyer?

We don't really know, because companies don't have to report the details on their activities when we ask them about it. They can claim that their business practices are protected information, and divulging them would hurt their competitiveness and put them at a disadvantage.

We can find out that states are selling our drivers license information because we run the states, and have the right to know what our government is doing. But companies? Ironically, we have no absolute right to find out what a private business is doing with our private information.