Once again proof that what we need is the opposite approach; companies need to actively get explicit permission not just from the end user, but also from authorities to collect and share data, and the full report should be publicly accessible. Also I wouldn't mind a general ban on using personal data for marketing purposes, I don't know a scenario where this would be necessary and beneficial for the user.

Right now companies just keep doing what they always did and hope for the best. As long as they're convinced they can just try not to get too much attention this data sharing problem will persist with barely a dent.