First, reform HIPPA (one of the rare privacy laws that the US actually has) to remove those blanket exceptions that grant governments, large companies, and rese

First, reform HIPPA (one of the rare privacy laws that the US actually has) to remove those blanket exceptions that grant governments, large companies, and research institutions the legal ability to abuse medical information without informed consent for every specific use. Remove the loopholes that allow "deidentified" data to not be treated as personal information. And specify that any time consent is asked for, there must be an equally presented option to deny it. Second, adopt a version of EU's GDPR, perhaps importing the text wholesale if congress is really unable to keep lobbyists from neutering the idea. Make sure it applies across the board, even to things like the traditional financial surveillance industry (paving over the "Fair" Credit Reporting Act), such that it's actually possible for an individual to delete themselves from these surveillance databases. Create a private right of action that superceeds any mandatory arbitration clauses, and empower the relevant regulatory agency so that we fast forward through this currency phase of companies attempting to continue business as usual figuring it will go away. After these basic steps, then we can start to talk about what else it takes for individuals to have trust in centralized systems to not abuse their data.