Politically, this framework is at the root of the problem. Currently, privacy violation is only policed based on method of access, rather than a larger general concept. We put "hackers" in prison for years for "breaking into an email account" because they shared a few people's private information, yet commercial surveillance bureaus are free to do whatever they want because the data is already "out there". Focusing solely on access kills any independent concept of privacy.

Specifying what exactly should be considered wrong is obviously a challenge. I think a business entity having someone's identifying information in a database without an ongoing business relationship could be a decent first pass. This difficulty is a large part of what has stunted progress. (Just FWIW my usual assumption is that information dissemination can't be stopped, but I don't think that assumption is necessarily true when talking about policing commercial entities that inherently have government charters.)

I'm actually more hopeful for technical solutions to the problem, even though they suffer from problems of scope, implementation, financing, and adoption. But coming up with a better external concept of privacy can guide such things too, especially encouraging incremental change in business models as opposed to the moon shot of repaving it all with Free software.