I don't see why this couldn't be regulated in the same way that HIPPA protects our health information.

Onerous regulation and business-killing fines have the added bonus of making the collection of personal data extremely unappealing. This is a case where the threat of regulation and enforcement has a strongly positive chilling effect on an industry.

And, if you're in an industry that must collect personal information for whatever reason, it's still possible and legal.