It seems, US legislation on customer data protection needs an upgrade and proper enforcement of ISO 27001 adoption across companies dealing with private personal data. The cheaper alternative exists. To prohibit completely storage of personal data, and only accept transactions with anonymous cryptocurrency.