There should be an authority to oversee the activities of the data handlers, which can hold them accountable.
There should be remedies for those subjects who are injured by malicious or irresponsible maintenance or use of their data.