[YeBanKo]

I think we still have an option of a privacy regulation that requires explicit expiring consent on any kind PII handling and a private right of action to enforce it (e.g. small claims court).