I don't know if Congress is the solution (http://thehill.com/policy/technology/215457-big-data-lobbyis...), I don't believe any branch of the US government has enough of an understanding with tech issues to pass effective regulation. I hope to be proven wrong though.
The most realistic way, in my opinion, to achieve some degree of reform is by encouraging businesses at a grassroots level to just simply not engage in these kinds of practices. That's an even tougher sell to many businesses than getting Congress to pass a law, but I'm heartened by companies like DuckDuckGo who build a product around the idea of "user privacy above all else". I think if that idea becomes popular enough and new businesses become noble enough to stick to their principals on issues of privacy (vs selling out to make $$) we might have an effective solution.
For what it's worth, members of Congress lack in-depth understanding of most things they legislate. Nobody can know that much about so many topics, almost anything under the Sun (and for NASA legislation, beyond thhe Sun too).
Perhaps we need an IT regulator, who develops expertise. That's how many industries are regulated.
Incidentally, that's part of the reason why I'm having this feeling, that the future is a choice - "privacy or progress, pick one". Because if you really, really care about privacy and anonymity, the sheer amount of otherwise very useful data you'd have to forbid processing and sharing of is staggering. Take for instance shopping. Should we prevent retailers from collecting transactions data? Should we prevent them from installing CCTVs to deter theft? If neither, then how we're going to prevent them from correlating those two sets to keep a profile on you?
(yes, I know retailers now use credit card data and club cards for that - but say one or both data sets will become unavailable - then they'll start looking for alternatives)
It's a serious question. I don't see reducing data collection as a viable strategy, and I'm not sure if we can present entities from sharing data sets with each other. I'd like to know what could be the long-term privacy perserving strategy that doesn't require us to roll back the computer age.