(1) Is anonymous click-stream tracking and profiling objectionable? Is sending targeted advertising information to a computer using cookie ID numbers objectionable?

(2) Private corporate data is often encrypted using a key, which is needed to decrypt the information. Who within the corporation should be responsible for maintaining the "keys" to private information collected about consumers? Is that the same person who should have the "keys" to employee data?