We need PII to be so toxic that companies run screaming from the liability unless they have explicit consent[1] and a legit reason to house it.
A company selling me widgets wouldn't store or let another company store extra information about me if it subjected them the widget seller to HIPAA. Or better yet, something more stringent.
We don't need the government to be antagonistic toward corporations; we just need a government that makes the corporations internalize the risk they're making us take.
[1] The fact that ToS are enforceable when every court in the country knows that only a vanishly small percentage of people ever read them, much less understand them, means that they're not doing their job.
A company selling me widgets wouldn't store or let another company store extra information about me if it subjected them the widget seller to HIPAA. Or better yet, something more stringent.
We don't need the government to be antagonistic toward corporations; we just need a government that makes the corporations internalize the risk they're making us take.
[1] The fact that ToS are enforceable when every court in the country knows that only a vanishly small percentage of people ever read them, much less understand them, means that they're not doing their job.