When it comes to damage-reduction, I think the most immediate step going forward that can be done on the side of the private sector is to stop collecting, as much as possible, extensive profiles on people, especially profiles that are, or easily can be, tied to their real identity. For those of us who aren't doing so ourselves, we can pressure companies not to do so, either those we work for, or those we interact with as customers. This can either mean not collecting profiles at all, collecting limited ones only as needed, and/or collecting them tied to pseudonyms rather than making use of real-names mandatory or default.

I realize it can be commercially valuable to have such profiles when it comes to things like targeting ads or financial instruments, but on the whole I think the damage such data can do, if it exists, outweighs that justification. To take a concrete example, the side of the internal Google+ "nymwars" who were against the real-name requirement were right.

Of course, we should also work to keep corporate and government data collection separate. But I fear that will be a longer-term struggle, in which case an avenue to pursue simultaneously is to minimize corporate data-collection.