Fatally flawed
The last requirement premise is flawed, since "sensitive" information is legally in the eye of the beholder (or, in this case, the person being classified). The courts will have to determine what the guidelines for sensitivity are. They've already spoken on social security and credit card numbers. Will the courts extend that protection to transaction histories that, for instance, Amazon uses to know that you bought a book on a particular subject? Doubt it, though they might require that it be held in a secure manner (such as encrypted). Or, how about the result of an analysis of purchases, e.g. that many of the books you buy are about business. Almost certainly not. How about the aggregated activities of a group of past customers, rather than an individual? Certainly not--though the analysis becomes more difficult if you can't gather all the data together in one place and time to perform analytics.
Biting the hand that feeds IT
