I think it's worth mentioning that GDPR was basically exactly this.

They're putting in systematic regulations to ensure that data isn't arbitrarily kept, it must be secure and the regulations have teeth. It's really well thought out - minimize the number of companies that have your data, minimize the data they have, minimize how long they can hold it for and hold them repsonsible for keeping it safe.

Yet, when these regulations were actually bought in, you can see especially on this forum, that people were incredibly sceptical. So whilst you might think that we need to be sensitive to private personal data, it seems like people disagree when it comes to actually implementing that.