I think that's essentially just what I described, with the main difference being that I think we'll only actually get there if we approach it from the angle of

I think that's essentially just what I described, with the main difference being that I think we'll only actually get there if we approach it from the angle of PII being something intrinsically owned by the individual, not the company that generated it, which I think is easiest approached by making it a right of some sort. Then the carved out allowances for specific companies or industries are clear and their need can always be weighed against our rights, making them much easier to pull back, because it's obvious when it comes to our rights and the needs of an industry to continue making money, our rights come first. If it's approached from a non-rights angle at some point we are attempting to curtail an industry, I think that might be a much more contentious discussion. If we can't get rights, I wouldn't mind HIPAA being expanded into an overall PII protection system with two or more levels, one being current HIPAA health info, and the other main one being all other PII info and that allows a company to collect it for internal use without lots of constraints (depending on info, and purely so it doesn't accidentally tank existing industries that aren't problematic because all of a sudden they can't store some benign info they need that the law accidentally targets) but once they want to share it at all they need to adopt a much more stringent framework like medical info requires for tracking and accounting of it, which would probably weed out the vast majority of random "collect the PII and sell it because it's cheap" stuff that goes on, since it's no longer low cost at all given the requirements that would exist around it (including authorization to share). Just the cost structure around strict legal and storage compliance and requiring authorization and tracking of all sharing of information would disincentivize a huge amount of the abuse we see.