I think you need to mandate the reporting of this information. It's not happening, otherwise. Whether it's private sector or public sector, in order to know what's going on, it needs to be mandated. One of the things we've been considering for the private sector is a requirement to notify individuals of the fact that their data are being shared with a foreign entity. In fact, it's certainly arguable that this is already a requirement under the private sector law, but I don't believe it's being fully complied with.
As I say, I think the first step is transparency and just getting all of this out in the open, and that needs to be mandated.