What has always bugged me is the the installed plugins/theme info sent to wp.org. Wordpress.org can identify each site by url and the plugins/themes installed and/or activated on it uniquely, along with the full plugin headers (author, name, author site, etc). And most importantly they do that for ALL plugins/themes, whether or not they came from the repo and have a valid reason for being sent (checking for updates).

Most worrying is the conflict of interest when it comes to WordPress.org vs Automattic. What kind of privacy policy covers that data? Does Automattic the for-profit corporation have access to this valuable information on their potential plugin, theme, and service competitors? Even if there are strict protocols in place there, the same guy runs both so there is information overlap. If I were building a competing plugin or service to one of automattic's (akismet, VaultPress, etc), they would have valuable data I don't for things like gauging potential demand or keeping an eye on competitors.

So why is wordpress sending info on things it doesn't? It should only send:
- Installed themes/plugins FROM THE REPO
- Their active status (useful for repo stats)
- Only their slug + version number (all header data is extraneous)

When I designed my own update notifications plugin (http://premium.wpmudev.org/project/update-notifications), I made sure it only sent the list of installed plugins of ours, as that's all that's needed and all that we have a right to.