> but in some cases, may have affected information such as name, contact and demographic information, date of birth, and
That's all you need to steal someone's identity. Major reason why I never give any website my real birthday, and use a password manager to remember all the various "birthdays" I've been required to provide for no ostensible reason.
If we wanted to hammer out a quick and effective privacy legislation, it would be: you need a demonstrable reason to ask for someone's birthday (e.g., legal reason to validate you're old enough to open a bank account or whatever), not "i want to send a happy birthday newsletter every year (and also sell it in a package to data brokers)"
That's all you need to steal someone's identity. Major reason why I never give any website my real birthday, and use a password manager to remember all the various "birthdays" I've been required to provide for no ostensible reason.
If we wanted to hammer out a quick and effective privacy legislation, it would be: you need a demonstrable reason to ask for someone's birthday (e.g., legal reason to validate you're old enough to open a bank account or whatever), not "i want to send a happy birthday newsletter every year (and also sell it in a package to data brokers)"