I'm not sure that legislation alone is really enough. Companies break laws all the time, if they feel they can get away with it. I'm sure I don't need to list

I'm not sure that legislation alone is really enough. Companies break laws all the time, if they feel they can get away with it. I'm sure I don't need to list any of the major corporate fraud cases that have plagued the news recently (from the major financial meltdown to Enron, etc), not to mention corporate fraud that's occurred in earlier days of even less regulation and oversight. Clearly, if data protection legislation is actually going to work there needs to be some way of verifying that companies are really following the law. That may mean there has to be some independent agency that actually investigates what corporations do with the data they collect. In the US, in the present political climate, such an agency is bound to be seen as overly intrusive in to private sector businesses, so there's bound to be much opposition to it (if the idea ever even sees the light of day). Even the prospects of serious data protection legislation in the US is only dimly glimpsed on the horizon at the moment. But even strong data protection legislation with strong oversight would not really address the core issue, which is that the corporations have data on you in the first place. In my opinion, the only way to address this issue is with a robust system of anonymity that connects consumers to providers and vendors. Fully anonymous money transfers, fully anonymous internet connections, and some way of keeping the provider and vendors from subverting these mechanisms via cookies, OS/browser fingerprinting, etc, would need to be part of this solution. Unfortunately, the political, legal, social, and technical challenges involved in such a scheme put it far in to the realm of science fiction for the foreseeable future.