Opt-in instead of opt-out

From Bruce Schneier's blog about a Wired editorial on identity theft:

Require opt-in rather than opt-out permission before companies can share or sell data.

Bingo. I recently received a letter from my credit card company saying that they were going to share my data with the regulatory authorities unless they heard from me within 30 days. Guess the situation applies here, too.