It's Data Privacy Day. Do you know where your data is? - CNET

"The purpose is kind of mysterious," said Sweeney, who's also an ex-chief technology officer for the Federal Trade Commission.

Sweeney and her research team want to reveal who's sharing your info. Their project, "All the Places Personal Data Goes," aims to illustrate the path your personal info takes from one place to another. On Tuesday, the Knight Foundation awarded the project $440,000 to expand.

That means Sweeney's group will keep using public-records requests and other methods to gather info on data buyers and sellers and make it available to joualists and other agents of change. The project will also soon host a data-visualization competition to bring the issue to life.

The Data Privacy Lab has already proved that some "anonymous" health care data can actually be pieced together to identify patients. In 2013, it published its unsettling discovery, which drew on hospital discharge records that had been collected by the state of Washington and that detailed everything from a patient's age and gender to diagnoses and treatments.

Sweeney's team was able to find news stories about car accidents and other emergencies and use them to put names to the records. After the team released its findings, Washington state changed its anonymization process.

That's the effect Sweeney hopes to have on a large scale: Shine a light on data and promote changes to protect privacy. Though the project started with health care, it's since expanded to cover data from mobile phones.

"What we really want to be able to do is cover the full waterfront," Sweeney said.

Power to the people

ForgeRock's Eve Maler thinks that in a world of growing distrust over where data goes, companies are ready to hear from customers about what info gets shared.

In the '90s, Maler coinvented XML, a popular coding system that lets software and online services exchange data automatically. Now she's pushing another system, one that lets Inteet users control their personal information.

Called User-Managed Access (UMA), the protocol forms a backbone that programmers can build on to give us more choice when we use services. After helping develop the protocol, Maler joined ForgeRock to create a UMA-based product companies can use in everyday services.

On Wednesday, ForgeRock launched that product, its Identity Platform. Philips is using the platform in health-care products to help patients share health data with doctors and others on a limited and revocable basis.

ForgeRock has also worked with New Zealand's govement to test a system that lets citizens safely choose to share with caregivers digitized records that help them get benefits.

The most important part of ForgeRock's system, Maler said, is the ability to opt into, rather than out of, sharing data. If you want to send workout information from your smartwatch, for example, you should be able to hit a button that says "share," rather than wonder to whom your watch is relaying your health stats.

Other companies are also looking at using the UMA protocol to create tools for letting users decide when to share.