This is why it needs to be dealt with via data privacy laws, not a one-off shoot-from-the-hip bit of executive action.

Privacy laws with escalating penalties up to a ban would accomplish the same thing, not just for for the high-profile panic examples of the moment, but for problems of this sort in general.