The law would also need a provision that the right to use someone else's personal information could only ever be licensed, and that license could be revoked at

The law would also need a provision that the right to use someone else's personal information could only ever be licensed, and that license could be revoked at any time. Otherwise the surveillance industry would just do the usual American dance of nullifying rights through contracts of adhesion. The FBI here is merely a symptom and the tip of the iceberg. The US sorely needs something akin to the GDPR, to prohibit this unaccountable shadow government that is the surveillance industry. I personally think passing the GDPR verbatim and letting the courts sort it out would be a decent approach given how our legislative process otherwise undermines regulation by letting corporate lobbyists buy exceptions that destroy the intent of the law while leaving only the bureaucratic red tape intact as an anticompetitive warning. But I do think that if the GDPR were to be translated into the US legal concepts, it would take the shape you've started to lay out.