Perhaps what should stop is the collection from the third parties and ability to sell them altogether?
"So the data isnt owned by the host company, its owned by the support company which is a child of the parent company. We are selling that child company to Amazon/FB/Google."
Google didn't buy nest because they were IOT fans.
2. Disseminating false info about a person should trigger a statutory defamation liability akin to statutory copy right infringement, where the person does not have to prove damages then expand the Credit Reporting laws to include all Information and force them to tell you who all they have sold or given that info to.
#2 would do the most, if we reform defamation to make it where if a credit reporting agency, or Google gets something wrong and tells someone else that wrong thing they are liable you would see a massive curbing of private information collection, and even more of it being up for sale.
In your case above, I’m not actually sure how data ownership works on sale of a company, but you can always have the company delete all your data if you don’t want it changing hands.
In other words, you should always own your data, and companies should never be able to do something with it that you do t consent to.