Introduce general data protection rules, then forbid data transfers to countries that cannot guarantee protection of users' data. That what's happening in the EU with US-based software.