Or just make the law so that the customers own their own private details, and not the company. If the company wishes to use private data for anything else than

Or just make the law so that the customers own their own private details, and not the company. If the company wishes to use private data for anything else than providing service to the customer, it must ask for permission. They can still pick ads based on the private data and personalise the user experience but they can not share or otherwise disclose it to anyone else.