Exactly. The root issue is that the US doesn't attach a dollar value to privacy.
Which is to say that if I have {personally identifiable information}, I have no innate {dollar risk} to holding it, outside of specific protected classes like personal health information (PHI).
If we wanted to fix this in one swoop, we could just... quantify that risk in $ terms. It largely worked as intended in healthcare via HIPAA.
- If you store PII, you are required to submit to a yearly audit by an independent third party
- If you have a breach that exposes PII, you are penalized order-of profits (or equivalent measure) for a year
- If you are a US company that obtains PII from a source outside your company, you are required to obtain and retain a full chain of custody of the source of that data. If you originate or sell PII, you are required to furnish a full chain of custody of that data. If you are found with PII without a valid chain of custody, you are dissolved as a company
That this would make some businesses like Experian or Facebook/Google's ad targeting products unprofitable to run is intended -- they're only profitable now because they don't have to pay to violate people's privacy.