* Consumers can control the use of that data.

* Consumers can dispose of or distribute that data as they choose.

He says a number of companies have expressed support for his principles, which he argues really aren't that different from the way financial institutions handle data already. Ultimately, companies need to decide whether the data they manage is their data or not.

"The 'privacy is dead' thing is just clearly wrong," says Pentland. "Yes, different people have different attitudes about privacy. But the part they care about is control. They're willing to put something up on Facebook but they want to control who sees it."

The ultimate privacy question for CIOs, then, is what it means for their companies to cede that control.