I know there are lots of reasonable concerns about unauthorized access to private information.

This is somewhat solved problem in other areas, like banking and government. Not zero, but asymptotically low.

I think we need to criminalize misuse more clearly, preferably on a federal level. We need clear justifications for each use of data. And, we should require periodic audits by an independent third party - perhaps funded in the purchase contracts as a line item and held in reserve.

This doesn’t solve the problem of legal use - which could be contentious now or in the future. But, this technology isn’t going away and good legislation to control it makes sense.