I'd go further and apply something like the notary/broker approach to the collection of data. Types of data should be defined in law. Some (say, email address) would be "free" to collect, but subject to strict sharing requirements like you describe (e.g., you can ask anyone for their email address, but you can't do anything with it except use it yourself to contact them). Others (mailing address) would be allowed for certain purposes (e.g., you need to mail the person a package). Companies should expect regular audits and stiff financial penalties if they collect such data but cannot objectively demonstrate that they actually need it to perform a service they are providing to the person who provides it. (This means you can't collect someone's mailing address unless you actually need it to do a specific thing for that person; simply using it as input to your internal analytics isn't good enough.) Others (e.g., location tracking) would require an approval process akin to being licensed to transport hazardous waste or something, so that it would be straight-up illegal to collect such data without prior approval. That approval process would involve full public disclosure of all intended uses of the data. You can't collect sensitive data without telling everyone exactly what you're going to do with it.

A large portion of the data that is illegally shared should never have been collected in the first place.