I think we've lost that war. So I think what we should be advocating isn't an ideal world that will never come to be but rather a hard push for privacy aware designs.

What I mean is that biometrics are going to be used one way or another, what we should make sure that the data can't be leaked original data can never be access again etc.

A different example would be healthcare data. In Germany spend so long lobbying that data should not be used until the new health minister just sneaked in a law or two to just give that data to insurances.

What we should be doing is design systems in a way that that data is actually accessible by default but also not abusable. I.e. only a subset research necessary PII filtered data should be available. But that way we could potentially have audited systems where we can make sure that the data is shared in a safe fashion and the other side can't do malicious things with it.

Because if we don't, once the data becomes available some government contractor will write the law (and the crappy software) with the Health Ministry acting as a defacto lobbyist for the insurance industry.