It is worth noting that there is no general data protection law in the US. If Mr Smathers had stolen credit card details then he could have been charged under privacy law, but just taking details of e-mail accounts is evidently fine.

And AOL itself will not be charged for being reckless with the personal details of its customers, because the US government believes that the market should deal with companies who do not take care of personal information.

Over here we have a very different view, and European data protection legislation is among the most restrictive in the world, reflecting our belief that people have a right to control how their personal details are used and that it should be backed up by law and not simply rely on imperfect consumer knowledge.

The first step has to be greater awareness of the issues, so that we are at least asking the right questions.