The law is not effectively addressing the potential harm caused by certain digital processing of personal data, as illustrated by the recent Google Spain judgment. A better way of dealing with privacy harms is to regulate at the point in the information lifecycle where the potential for harm is created. This article will review the Google Spain decision and reactions to it, consider the implications for new technologies that facilitate surveillance and profiling by individuals, such as Google Glass, and suggest that permitting limited privacy vigilantism might have a role to play in the solution.