One of my thoughts is in theory credit agencies are heavily regulated. That needs to be extended to any business that aggregates data on people as it's primary

One of my thoughts is in theory credit agencies are heavily regulated. That needs to be extended to any business that aggregates data on people as it's primary business. And regulators should be able to tell them no. As in, no you can't collect that information. And no that individual can't work for you. You need signed authorization to share that data. Each time.