Comment by jsrozner

Most laws are designed to accomplish specific objectives. For example, there might be laws about whether you can collect certain kinds of data, for the sake of privacy or protecting some attribute. As technology improves, however, it may become possible to collect different kinds of data (that are not regulated to not be collected) and still recover the original attribute.

For example, 20 years ago, few people would have imagined that you could build a fingerprint of a person from all their behaviors on the internet. You didn't need to regulate away certain kinds of data collection to prevent such fingerprinting because it wasn't possible. With ML and AI, it has become possible.

My point is that as technology improves, "de-identification" takes on new meaning. Whatever de-identification was 20 years ago is not what de-identification is today. And whatever de-identification was used here is probably insufficient to guarantee that customers can't be identified.

We need new regulations and we need them yesterday.