This is going to be a fairly controversial opinion, and I fully expect this text to end up about one shade off white approximately five minutes after posting (at least if my last few attempts mean anything, hence the following wall of text), but I notice a few things, without fail, whenever this topic comes up.
1) The advocates for all of these restrictions on data are incapable of doing so without resorting to flawed arguments, if not outright scaremongering.
A couple selected pieces from this article:
* "If you've ever wondered why Facebook is such a joyless place.."
Can't say I have. Perhaps your Facebook interactions are all dour and joyless because the people you interact with are dour and joyless online? In any case, it's hardly proper to speak this opinion as if it were fact.
* Comparison of ad targeting data to the "pink files" collected for the express purpose of destroying LGBTs, or data collected by various secret police.
Why this is problematic is left as an exercise for the reader.
I'm going to coin a phrase here. You know "reductio ad absurdum"? I'm going to call this "reductio ad missionem malum" - reduction to the worst case scenario. A close relative of the slippery slope.
In this case, the thesis appears to be "Lots of data is collected, therefore burn it all to the ground because it can be misused by the bad guys with guns."
2) Their arguments are not followed to their logical conclusion.
Much hand wringing is done (not by the author necessarily, but in general) about the world when everyone's "youthful indiscretions" and "every mistake" are available online, permanently, for the world to see. Fast forward a decade or so after that line is crossed. What happens when everyone has dirt on everyone? Does that not greatly lessen this impact? It's pretty hard for the guys in suits and dark glasses to blackmail you for something when that information is already out there.
It would be a type of "post-privacy" society, in other words. It is fundamentally different from what we have now, where we have a public personality and a private personality. This carries some positives, some negatives, and I feel it has yet to be discussed in an objective way.
3) Instead of advocating for greater privacy controls that make sense, they instead advocate for measures like the EU's misaimed and "feel good" "right to be forgotten" law.
Look at what the author advocates for:
* "Limit what kind of behavioral data websites can store. When I say behavioral data, I mean the kinds of things computers notice about you in passing—your search history, what you click on, what cell tower you're using."
I for one GREATLY LOOK FORWARD to the day when bureaucrats tell me how my nginx access logs must be formatted and stored (after all, they contain, fairly explicitly "what you click on"). I also look forward with the same enthusiasm to how such a thing will ever be enforced and to find out how much money will be allocated to this particular measure.
I think this is approaching the problem from the wrong angle.
The author says that this is an implementation problem. I, for one, do not want that implementation decided by people who don't understand how technology works. Unfortunately, that seems to be the case whenever you have tech-by-legislative-diktat.
Let me give you an example by way of the next item:
* "Enforce the right to delete. I should be able to delete my account and leave no trace in your system, modulo some reasonable allowance for backups."
Remember how I said the EU law was misaimed and "feel good"? A case where this would do more harm than good: Hacker News. Or indeed any other discussion forum or mailing list archive. Imagine a prolific and quality contributor here, like such as tpacek or even PG. Now imagine that for whatever reason, one of these people want to be "forgotten" and invoke this law.
Imagine what this would do to every single thread that person has ever participated in. Context would be utterly annihilated. This would eviscerate, in the most disgusting sense of the word, most any discussion forum.
I came up with this edge case in less than 60 seconds of thought, and I don't even begin to rank on the list of smartest people on HN. If I can locate such a problem with so little effort, that means both that the people who wrote this law don't know what the fuck they're on about, and it also means that worse edge cases probably exist.
I would say that the legislation needs to target behavior, not tech. Ensuring that private data remains so even after mergers, acquisitions, etc? Excellent. Penalties on companies that misstep? Great idea. Ensuring that government types have to go through the full judicial processes (none of this secret-court-rubber-stamp malarky) to access this data? Awesome!
Making me destroy my website because someone wants to disappear themselves? Less so.