We need to strengthen consumer data protection. GDPR has some good ideas; no collecting PII without permission, consumers have the right to revoke/delete, and t

We need to strengthen consumer data protection. GDPR has some good ideas; no collecting PII without permission, consumers have the right to revoke/delete, and the key piece for this thread is the requirement for the Controller to have a contract with any Subprocessors to enforce the right to deletion transitively (and inform data subjects of the list of Subprocessors with which their data is being shared). CCPA was in the right direction, but AFAICT it explicitly carved out exemptions for credit bureaus. We need to tighten the screws on these businesses; the only way we’ll see improvement here is if we hold them liable for damages and breaches. Right now they have very little incentive to care for this data, and all the incentive to try and monetize it as much as possible.