1) Discuss what experiences have you had where, to the best of your knowledge, your personal data has been collected following some (or all) of the above criteria? How about when, to the best of your knowledge, some (or all) of the above criteria has NOT been followed?

2)Discuss the trade-offs between better personal data protection and cost-of-services. Who in your opinion should drive such GDPR-like standards in the US, should it be the US government or should we rely on the Market to drive it?