Fundamentally we need controls on how both the state and private industry can store, use, and share such data.

Playing whack-a-mole with each specific type of surveillance and company involved isn't really fixing the issue.

What is the wrong thing to do?

I could have been more clear. Mass surveillance is not something for which we should be issuing and revoking permits or licenses. It should be simply illegal full stop.