What has always mattered most is impact, led by a deeply held belief that people must come before profits.

23andMe confirmed hackers used stolen credentials from other hacks to gain access to accounts, which a report says were then used to find and scrape other users’ information.

At least a dozen U.S. National Security Agency employees have been caught using secret government surveillance tools to spy on the emails or phone calls of their current or former spouses and lovers in the past decade, according to the intelligence agency's internal watchdog...

phone numbers for discovery are terrible

"Nothing users type is sent to Google servers"
"... powered by system intelligence running entirely on device"
"... keeping everything individual users type on their device"

Privacy Commissioner of Canada's guidelines for fingerprint use

Covert collection: People should be informed if their personal information is being collected.
Cross-matching: Personal information should only be used for the purpose for which it was collected.
Secondary Information: Personal information should only be collected for a clearly identified purpose.

smell test:
Necessity: Is the measure demonstrably necessary to meet a specific need?
Effectiveness: Is it likely to be effective in meeting that need?
Proportionality: Would the loss of privacy be proportionate to the benefit gained?
Alternatives: Is there a less privacy-invasive way of achieving the same end?

guidelines for implementation:
record only summary information
use only for verification, not identification
store locally, rather than in central databases

In our exercise, we built a database using only photos from public websites