To use Buzz, you need a public Google profile. This was true on Day 1, and it's true now. Any info that was revealed was already googleable, public information that the user filled out explicitly for a public page.
edit: downvotes? What, don't like the truth? If I've got something wrong, speak up.
How would you feel if somebody took the top few contacts in your address book and shared them all with each other? That is exactly what Google has done.
As a freelancer would you want the email addresses of your top 6 clients all exposed to each other?
Would you want to explain to your current significant other why you are now following your ex-girlfriends Google buzz? Would you want them to have each others contact info?
Would you want your top six most emailed contacts to be publicly available to your current employer?
Whether people opted in to this behavior via some obscure, hard to understand TOS agreement or not is immaterial. The end result is just poor design though and through.
The Data that was exposed was in effect, who your top 6 or so most emailed contacts are.
Only if you have the box which says it makes your following-list public to people following you checked and they set up their public profile. If it's not checked, then no, they can't see the data. Try checking someone you're following who has that box un-checked, and all you'll see is their public profile page and whether or not they're following you.
Again. It's opt-in, and only shows things which are public anyway. If you see a request to make things public, like Buzz offered from day 1, then for the love of God, READ what's being made public. Especially if you have sensitive data on the account, or use it professionally. It was idiotic of them to check the box by default, but individuals are still responsible for leaving it checked.
edit: The original notification: http://img694.imageshack.us/i/buzzflaw.jpg/ Note that it says "people you follow, and people who follow you". Editing your profile via the edit link before approving allowed you to turn off the "people you follow" display, and now there's a checkbox right on that popup (which should've been there to begin with, but still).
edit2: bah, static link fail. Updated link. Original source: http://is.gd/8Fduj
Just because the option is there and is easy for techies to find doesn't mean that it is reasonable to expect actual not particularly computer literate users to figure it out and uncheck the box if they don't want it.
I agree with the initial design errors, but there's never been a privacy leak in Buzz that people didn't tell to exist.
The default behavior shouldn't be to make that list public. I think that is where people are taking issue.
2. The subset of my contacts that clicked "yes" became exposed to the public. Are you claiming my address book was previously public?
3. Didn't Google make the public profile for me? I sure didn't. You make it sound like that was a steep barrier to entry to buzz?
Not on your profile.
"Didn't Google make the public profile for me"
It didn't. If you never set up a google profile or a buzz profile, Buzz displays a placeholder profile to your contacts with the sentence "This person does not have a public profile." where the name usually is. If you had a Google Profile, your contacts are shown a placeholder profile with your name and a link to your Google profile.
Certainly in the latter case and maybe the former, your following/follower lists are displayed to you on your placeholder buzz profile, but these are not displayed to anyone else looking at the profile.
This was all much less terrible than I thought. If no private data was exposed, this was mostly just an inconvenience rather than a horrible breach of privacy, which I'm glad to hear.
Thanks for clarifying!
"Show the list of people I'm following and the list of people following me on my public Google profile Learn more"
So that list of followers (people who simply didn't read the splash page and blindly picked "yes") WERE exposed to the public.
They've effectively addressed this by having a simple completely disabling link now, but I still don't like how it requires deleting your public profile. What if I have a public Picasaweb page?
I'll admit, I pulled a tl;dr on the welcome screen; I typically do, welcome screens are rarely worth more than a quick scan. Expecting the "no thanks" link to refer to buzz is pretty much my mistake, though it could've been clearer.
edit: and as others have addressed (carbon8 this time), 2 and 3 are still incorrect, even from the beginning.