Control of private data is now clearly vested in the individual – with very few statutory exceptions

Corporations can only use it for purposes that are

  • pre-defined
  • explicit
  • with the full agreement of the individual in advance