If you don't own your data, you don't have any privacy.
Yes, that is very hard to properly regulate, leaves a lot of fair use grey areas and with the rapid pace of technologies leads to hastily created regulation like the "cookie-law" or the right-to-be-forgotten. (Although in both cases the industry deliberately made a circus of the implementation, and especially the latter is now backfiring hard on Google.)
But the bottom line is, if the law doesn't recognize your fundamental ownership of your data, you have no privacy and you never will, no matter what other forms of legislation and self-regulation get implemented in the areas of collecting and using that data.
The US is one of the few Western democracies that doesn't recognize this fundamental aspect of privacy, and in the information age, that makes any form of privacy regulation a complete joke.
Step one should be to put the individual in control of their data at any time. If people are not informed about what happens to their data if and when it happens and are not in a position to stop it, they've already lost their privacy.
Privacy should not be a faux "right" like copyright, something you can just sign away for someone else to exploit. It's a fundamental civil right, and without it we have no freedom.