I agree with OP. People are mostly over-reacting. Trying to regulate the collection of personal data is a waste of time.
We should be focused on limiting the 'evil' applications of personal data, regardless of the source. If an employer, bank, or insurance company discriminates against you on the basis of personal data they purchased from Facebook, Facebook isn't the offender.
We regulate the credit rating agencies and how credit scores can be used. That's sufficient. Why wouldn't a similar model work for personal data?
Facebook is the offender for gathering all that un-needed personal data; and then for processing it; and then for selling it without the permission of the data-owner.
To be clear: Gathering too much personal data, and holding it (even when the user has asked for it to be deleted) is itself an evil application, and that is why the EU has laws about it.
We should be focused on limiting the 'evil' applications of personal data, regardless of the source. If an employer, bank, or insurance company discriminates against you on the basis of personal data they purchased from Facebook, Facebook isn't the offender.
We regulate the credit rating agencies and how credit scores can be used. That's sufficient. Why wouldn't a similar model work for personal data?