A system that allows you to be the broker of your data really seems like the right way to go. Similar to app permissions, users could choose which aspects of t

A system that allows you to be the broker of your data really seems like the right way to go. Similar to app permissions, users could choose which aspects of their data/profile to share with each company. The data could then be accessed via a federated API. With this in place, you could make it illegal for companies to store any PII themselves. Of course whoever controls that central user repo would have great power.