It's already illegal in Europe, as long as the data falls into the PII category.