  Initially, concerns about personal information that can be gathered and exchanged electronically focused mainly on NPI. In response to these concerns, some specific privacy laws and policies were established to protect NPI. But many privacy advocates now also worry about the ways in which PPI is routinely collected and analyzed via digital technologies. They have argued that PPI deserves greater legal and normative protection than it currently has. Nissenbaum (1997, 1998) has referred to the challenge that we face with regard to protecting (the kind of information that we refer to as) PPI as the “problem of protecting privacy in public.” Some privacy advocates argue that our earlier assumptions about what kinds of publicly available information about us need explicit legal protection (or perhaps some kind of less formal “normative” protection, at the level of policies) are no longer adequate because of the way much of that information can now be processed via digital technologies, especially in the commercial sphere. For example, seemingly innocuous information about persons, based on their activities in the public sphere, can be “mined” to create user profiles based on implicit patterns in the data and those profiles (whether accurate or not) can be used to make important decisions affecting people.