It is worth noting that there is no general data protection law in the US. If Mr Smathers had stolen credit card details then he could have been charged under privacy law, but just taking details of e-mail accounts is evidently fine.
And AOL itself will not be charged for being reckless with the personal details of its customers, because the US government believes that the market should deal with companies who do not take care of personal information. Over here we have a very different view, and European data protection legislation is among the most restrictive in the world, reflecting our belief that people have a right to control how their personal details are used and that it should be backed up by law and not simply rely on imperfect consumer knowledge. The first step has to be greater awareness of the issues, so that we are at least asking the right questions. So perhaps AOL's embarrassment can help us all in the long run by making us think about trust and who really deserves it. In the unlikely event your DNS Whois case needs further bolstering, you can highlight the specific and substantial differences between the US and Europe that are cited here. (Your Circle ID article referred to Canada in a for-instance kind of way.) ICANN should not attempt to impose US legal authority on European domain name holders in the .com GTLD. In the net we trust | 
