1. Would you apply these rights to enterprise/intranet social networks?

2. Do your rights supercede an employer's rights to manage workplace information, especially if it is to comply with laws and regulations?

3. How do we define "ownership"? Can we spell this out?

4. "activity stream of content they create" conflates two different sets of data. Do I own my "activity stream", the metadata describing my activity on the site, including which pages I visit, forms I fill out, things I click? Would this include things like web site log files? Do I own "content I create" even if it is a collaborative work?

5. Do you provide exceptions for "except to comply with the law" and "to operate our site" to the "Control of whether and how such personal information is shared with others"?

6. Can we provide a model Terms Of Service that encapsulates these ideas?

7. Must these rights be transferable? What do you want to happen when a company agreeing to these rights is bought by a company that does not agree?

8. Must a company agree to provide escrow for this data, in the event of bankruptcy or takeover by an organization that does not comply with BORUS? Failing escrow, would you rather have the company commit to destroying all copies of your data than having it fall into non-BORUS hands?

9. In addition to syndication, should your host be required to keep permanent archives of your data? Some sites discard old data.

10. Should you be allowed to download your data in a documented, machine readable form? Blog services, starting with Dave Winer's Manila, have done this for years.

11. Do your rights of ownership include withdrawing public posts and public comments, even killing open public groups you may have created, should you choose to disappear from view on their site?

12. Do I have the right to edit information about me in other people's address books?

13. Which of these rights extend to groups of people or other objects I've defined in your network?

14. Is the "Allow their users to discover who else they know is also on their site, using the same external identifiers made available for lookup within the service" subject to "Control of whether and how such personal information is shared with others"?

15. Does "personal information" include information about you obtained from third parties? The way credit card companies or people-search firms do? Or the way online advertising agencies do? For example, if a facebook app shows your eBay score to other people, do you have the right to compel the site to hide that otherwise public information?

16. What are "external identifiers"? Are you referring to OpenID style logins? Or my usernames in other networks?

17. Some networks, like Skype, decentralize data, making it hard or impossible to comply with some of the syndication and linking or web access clauses. Can the language be generalized?

18. Should you insist on services defaulting to privacy instead of openness when they expose profiles to public search engines?

I wrote a Desktop Bill of Rights back in 1996 to set expectations between the LSI Logic IT department and its internal customers. Communication is great, governance is better. I like Matthew Green Smith's suggestion: create a company to put a seal-of-approval on compliant services.

I agree that with Scoble that, like privacy and consumer protections, "Most people just don’t care about this." Pete Cashmore asks "Do 99% of those users on social networks care about this stuff anyway?" We'll see.