Fundamentally we need controls on how both the state and private industry can store, use, and share such data.

Playing whack-a-mole with each specific type of surveillance and company involved isn't really fixing the issue.