I agree this is all good but you're missing one important point: if someone breaks the rules, there need to be clear and obvious prison sentences for the manufacturer and/or police involved, and a large payout to everyone who's data is affected, and large whistleblower rewards if you report such a crime.