I think there should definitely be a distinction, and that distinction needs to be enforced by law, between required data and voluntary data. A certain amount of data is required in some industries to be collected and it is required by law. There is also a data that place is voluntarily ask for but that should be made clear that this is voluntary and not required. If the business is requiring this voluntary data in order to do business with them there should be an expectation that you understand how that data will be used. If that data is misused lost or mishandled the punishments for the business should be equivalent to that of entrusting any physical property to the business that was mishandled.

Businesses love to post signs that they are not liable for XYZ damage that may occur to your property. Often times this is not true. When you entrust your property to a business you have an expectation that they will provide reasonable care and security to that property and that it will be returned to you in the same condition. It doesn't matter that they have signs or contracts saying you're releasing them from liability. Negligence on their part is always a cause for liability. Unfortunately businesses have better lobbyists so this will never come to pass as law.

There is another problem as well. Sometimes the government requires a certain information to be collected but only of a certain class of people. Businesses then will enforce that across everyone. The mind's numbed robots you're dealing with will simply refuse you service because you're not complying with their policy even though the law doesn't require this. I can give you an example that I had a couple weeks ago and this is the first time it's ever happened to me. When traveling to the United States covid contact tracing information is still required to be collected for people who are not citizens or lawful permanent residents and maybe one other class of people. Visitors tourists etc are required to provide contact information and a location where they're staying. This is very clear when you go look up travel information and it always lists that this information is required except for citizens etc. this time when I was flying Delta and Korean Air they asked me for this information and I told them that I do not have to provide it because I am a US citizen and you can validate that because I have a US passport. They told me it was required for them to collect it and to refer to border controls policies and the cdc's policies. So I pulled it up on my phone the government website and showed them that this is not required of US citizens. Apparently Delta and sky teams policy recently changed that they require this information of all people traveling to the United States without exception. They showed me their internal memo that did not list the exceptions but curious enough it did list the government websites that should be referred to for more information on why they're collecting it. Those same websites that list that citizens do not have to provide this.

This is the kind of violation that should cause an airline to be shut down because they are refusing re-entry into someone's home country for a policy that has nothing to do with the law. Of course there is no escalation point no one to call You're simply stuck overseas refused to give a boarding pass for your flight.