People who complain that "that could make any URL illegal!" are being facetious: if you hit a site once and see personally identifiable information (PII), report it and leave! It's like if you were out hiking and you wandered onto someone's land: one incursion isn't going to get you thrown in jail, but repeated, systematic incursions will make it hard for you to argue that it was an accident.
If you really want more explicit laws on this sort of stuff, you're going to end up with a ton of very explicit cruft all over the web. You know those email footers saying "If you aren't the intended recipient, throw this away"? The best we can expect is to require sites to put those boilerplate warnings on pages you aren't supposed to access. These would be analogous to 'no trespassing' signs in real life.