"Make it illegal to collect or store personal information on anyone you don't have a business relationship with." Let's assume we are going to go ahead with th

"Make it illegal to collect or store personal information on anyone you don't have a business relationship with." Let's assume we are going to go ahead with this idea. (FWIW, I think targeting collection and storage it is the right starting point.) Would it make more sense to make it a criminal offence, a civil one or both? The word "illegal" usually refers to criminal, not civil law. However the comment refers to "civil penalties". Should we think about who is going to enforce the law, who will pay the cost of that enforcement and how unauthorised collection and storage may be discovered. Who enforces criminal law? Who enforces civil law?