Second Circuit Examines Factors for 'Future Injury' from Personal Information Disclosure

But that ubiquity comes with some associated risk. Each interconnected service we use increases our digital "footprint" — the trove of information about us (accurate or not) that is available online. In some cases we may explicitly agree to share that information, in others it may be collected without our knowledge, but absent extraordinary measures, information about us is constantly being collected, stored, indexed and shared. This includes not only personally identifiable information (PII) such as names, addresses, dates of birth and Social Security numbers, but also associated demographic and preference profiles, built up through the tracking of Web activity, online commerce, or even geolocation. While PII is often explicitly protected by laws or regulations, the associated profile data generally is not, and that information is often freely shared among connected services. This may be unsettling, but it is not illegal — it's simply part of the bargain we have made as an online society.

The problem arises when the system breaks. These services are designed for ease of use, but easy communication and transmission make mistakes (and malicious attacks) more costly and more likely. An Amazon account isn't much use without a linked payment method; mobile banking isn't possible without sharing a tax identification number; company emails will inevitably contain sensitive business information. But as we entrust more and more sensitive data to these services, they become fodder for unintentional disclosure, whether through inadvertence or breach.