we need to work our way through legislation to fix this.

US laws generally do not encompass the right to privacy - whilst US legislation addresses data security and the importance of private records, privacy is often absent from the discussion, appearing in separate privacy laws.

We can look to the EU for help, GDPR is geared towards a person's RIGHT TO PRIVACY.