We need better data privacy self-regulation

No. What you need is to be forced, on penalty of imprisonment, to treat all customer data as if they were medical records -- or, better yet, nuclear waste.