> They then expected Facebook not to correlate this data with others who contact and visit the same doctor. Why not?
Because that would be a dick move.
But clearly that is not enough to dissuade companies from doing this kind of thing, because they have no morals.
And that is the crux of the problem. They don't give a shit what would be considered "reasonable behaviour" for a human being, because they are just giant correlating machines with access to data they shouldn't have been given access to by people who don't know better.
At the end of the day, we are allowed to have reasonable expectations of others, including companies, so I take issue with any implication that they should have known better. We are allowed to have these reasonable expectations. And we will be constantly disappointed. But we should maintain them, I might even say that it is a duty to do so.
Saying "they should have known better" is giving up the fight prematurely. They shouldn't have to know better. They should be able to expect that their privacy (a right) will not be violated.
It is an ideal, not a reality, but it is something to work towards. One step might be to sue the hell out of Facebook for this.
