The loophole is regulatory capture. The laws are written strongly, then watered down by self-interested companies throwing money at the legislative pipeline.

I don't know the answer to this, but it would probably be a crisis of some sort, like cambridge analytica.

It's sort of amazing how far out of hand things have gotten, with phones, cars, televisions, and more collecting data and matching it with your "dossier(s) in the cloud"