We need privacy laws that apply to government and private sector alike. This is done elsewhere: the GDPR, for instance, applies (with some obvious exceptions) to law enforcement agencies.