Instead of a tax, how about extending the cumbersome PCI Compliance regulations to all personal data? How many of you would store credit card numbers willy nilly today even if asked by a client? :-)