Creepiness Is in the Eye of the Beholder [Opinion]

As a privacy adviser, I am often called upon to determine whether or how a particular initiative can comply with privacy law. But often a more compelling and relevant question is: will this project fly, or will it crash and burn? The answer to both questions is often “it depends.” The principles set down in privacy laws in Australia and around the world are examples of what's known as fuzzy law, meaning they offer plenty of blank space around phrases like “reasonable expectations” and “take reasonable steps,” that the privacy adviser has to fill in. And then even if you do comply with the law, a backlash from your customers or the wider public can bring your project undone faster than you can say “Australia Card” (a national identity card proposed by the Australian Government which sank in 1987 due to massive public opposition to the scheme). So how are we supposed to figure out in advance what will be considered unduly privacy invasive, and what won't?