Um, it doesn't have too... Why not start with re-reading existing consumer data protection law? I bet there's stuff in there that can be applied and reworked.

Um, it doesn't have too... Why not start with re-reading existing consumer data protection law? I bet there's stuff in there that can be applied and reworked. We need it to be appropriately scary for companies to abuse data.