I strongly dislike that reply, because

1. it fails to address their actual argument, which is that they have nothing to hide from companies or the government, especially law enforcement.

2. it fails to convey the actual threat of loss of privacy: the threat to democracy and freedom of speech when journalists can't protect their sources, lawyers can't be trusted by their clients, etc.

I therefore prefer to emphasise that latter point, that even though they might have nothing to hide, people they should care about do.

Although lately it's become easier to convince people that even they have something to hide: as political actors (e.g. Cambridge Analytica) learn more about them from their data, they can target you (and people like you) with tailor-made lies to influence who you (and people like you) vote for.

Doesn't convince or even interest everyone, of course, but more than before.

I'm not sure that actually helps, because most people don't consider personal embarrassment similar to the serious reasons privacy is important.

For example, the consequence of the bathroom door being opened is fairly predictable and honestly, benign. But the consequence of someone gaining power of your life through knowing information that you thought was private is quite unfathomable. Which is why we often describe it as "creepy" even though we can't actually assign any specific negative consequence to it. Perhaps the most important thing of all is that humans have simply evolved to have this "creepy" detector as a built in defense mechanism, and we find it very disturbing and psychologically upsetting when it goes off. The simple fact that this is the human condition (whether valid or not) is sufficient to warrant it being respected.

A better reply is: "Saying you don't care about privacy because you have nothing to hide is the same as saying you don't care about free speech because you have nothing to say."

And yet you guard your drink at a big open party, not because you want to hide what you're drinking, but because you don't want some creepy strangers meddling with it to take advantage of you.

respect for others that don't want to see me half naked while on the toilet? I don't lock the bathroom door at home.

I once heard a better phrase, but I now realise I've forgotten it and can only paraphrase.. But it was something like, "There's a difference between annonymity and privacy. Privacy is when you go toilet and lock the door even though everyone knows what you're doing".

I wish I could rememnber the phrase!

There exist social norms for bathroom use, but many yet for online privacy. You may be more effectual in your approach with a more direct recognition of this fact, for example by explaining that un-encrypted email may be retained forever and used in unexpected ways, like for marketing purposes, or to train machine learning models. These obvious violation of personal data ownership are more palpable and a stronger call for action, I think.

Or the Bradley Chait / Edward Drummond email (I'm reassigning noteriety to the violators of privacy norms, not its victim):

https://www.snopes.com/fact-check/under-the-yum-yum-tree/