Privacy laws, which focus on Notice and Choice, fall short of addressing the capabilities, opportunities and interests of individuals in a data driven society. The talk will discuss the fundamental principles of legal protection of privacy, using biometric data as a case study. It will also identify the gaps in this legal approach, and offer a few thoughts on how to fix it.