The headlines about privacy breaches keep coming in.

Hewlett-Packard's pretexting scandal is being cited as an example of a new and growing form of anti-privacy skullduggery and privacy is on the agenda for the new Congress.

The problem with privacy is that the technology moves faster than the law. Legal protections can be so weak and governments are always playing catch up.

David Holtzman from GlobalPOV says the problem is that companies treat privacy as a legal, not an ethical, issue. As a result, stuff keeps slipping through the cracks.

He lists core ethical guidelines in this piece The Seven Principles of Privacy: Protect Your Customers' Privacy Ethically, Not Legally .

The principles are really a matter of common sense:

1. Don't spy on me just because you can.

2. Thou shalt erase my data.

3. Keep my information to thyself

4. Don't judge and categorize me

5. Protect my data like it were thine own.

6. I am who I say I am.

7. Don't humiliate me.

Holtzman makes the excellent point that the law is a blunt instrument. Indeed, if there's a lesson out of the Hewlett-Packard case it's that first principles have to start with the ethics. HP's problem was that it's ethics officer was also one of its lawyers.

As Holtzman writes:

"If the law cannot protect privacy, then the last person who should be in charge of formulating privacy policy should be a lawyer; ye in most firms, guess who the Chief Privacy Officer is, in the unlikely event that there is actually one? If you guessed "a lawyer" you'd be right almost every time. Usually privacy falls into the domain of the company's General Counsel (GC), where it's out of sight. It's quite fashionable for business executives to treat privacy problems like fires and privacy officers like insurance agents, ignoring them until it's cleanup time.

"Laws make poor privacy guidelines. Business people need better directions when navigating their customer relationships than simply to simply to be told to steer around legal road blocks. Boardroom discussions should be less about what is permissable and prohibited and more about what is positive and proactive - in short, what is ethical. The question should not be 'Can we do this?' but 'Should we do this?' "