[dannyw]

At the very least, when a company acquires my data through any mechanism, it should be forced to email me with a copy of all the data they have on me, and with a one click link to get them to delete the data and permanently opt out.

Any company found in procession of personal data without the appropriate (delivered) email notifications being sent should be fined at minimum $1000 per individual, and criminal charges if intentional.

This won't put anything like services you voluntarily sign up for out of business (as they send sign up confirmations anyway, or should).

[rckoepke]

This would severely backfire if the data broker thought someone else's email account was associated with your identity. Say:

Danny W[ilkins]

- Job Title

- Salary

- Job application records

- Social media post history

- Email 1: [e-mail] (correct)

- Email 2: [e-mail] (correct)

- Email 3: [e-mail] (not correct)

I'd assume they'd send the email containing your salary and post history to the two valid emails as well as the one invalid email.

That seems like a potential nightmare for you, for example records of job searches being sent to your employer email.

[rolandog]

Also, there's the situation of people who receive a lot of emails from services where the user mistyped their email, but the service doesn't validate the registered email.

In my case, I always feel I'm fighting a losing battle against the horde of emails addressed to users of unknown services...

There are a growing number of services that validate the email and include a "I didn't register at this service".

This has me worried, because I can imagine so many scenarios where the metadata aggregators scrape and mis-classify by email:

A teenage boy using a Snapchat-like service had created an account with my email and I had to manually delete it; some guy used my email to register his account at a MacDonald's franchise's ERP; I once received a booking confirmation from some large airline (and Google nicely reminded me that I had an upcoming flight); also, I was once wrongfully tagged by email in an unlisted web album of a party that had taken place in a French village by an older lady.

I always try to reach out to notify the person... But sometimes it's hard to call a Peruvian bank to notify them that one of their account holders used my email to register his account, and they tell you they'll get around to notifying the user, but don't.

Now; I could imagine several scenarios where things might get bumpy for me in the near future...

Like in the event where someone tries to forecast criminal behavior; or what if a government thinks I should be paying taxes on some income that their metadata suggests I have (because, why else would you have emails in your inbox from that bank?).

[AJ007]

Does that have to be the email account you registered with that business? It definitely is concerning if someone could effortlessly assemble a database of all of this information just by getting control of your email address. Chat logs, Alexa recordings, geo locations going back years, every Uber ride you ever called and the addresses you came and went to.

Even the deletion requests could cause an identity theft nightmare. One hack and all of your Facebook, Apple, Google, Microsoft, Steam/Blizzard/Any game company, identify and digital assets are gone forever with no chance of return.

[hjotp5]

There’s this odd grey area , it seems Zillow is claiming it’s publicly available data which I believe they are right as the data comes from government lease knowledge. So you don’t own your name and address. If I own a business that wants to use machine learning and guess if you are republican or Democrat based on your house location do you own that guess when I sell it? Is that your data?