Yes and: Require opt-in by default. In all cases. All PII data at rest must be encrypted at the field level. Like how passwords should be stored. aka Transluc

Yes and: Require opt-in by default. In all cases. All PII data at rest must be encrypted at the field level. Like how passwords should be stored. aka Translucent Database techniques. Not just in transit. Not just encrypting the whole database. But encrypt the actual fields within a database. Constitutional privacy means personal sovereignty over oneself. (A superset of the folk definition of keeping secrets.) Meaning any and all data about me is owned by me. Any one using my data for any purpose has to pay me. (See opt-in by default above.)