It's very hard to understand.
There need to be significant penalties, a rights-based approach, and more flexibility in how data is used. This must go hand in hand with greater corporate accountability. Among other things, this means that the regulatory agency can, not arbitrarily, but by being focused on its assessment of the environment, do proactive audits and not wait until there is a privacy breach. A proactive aspect is very important to properly protect consumer privacy, in my opinion.