One aspect of this that should be enshrined into law is that privacy violations must be litigated. "Binding" arbitration won't cut it.