Expand the already recognized "Right of Privacy", by making data about a person property of that person.
Certain narrow exceptions (for matters of public record, law enforcement needs when a warrant is issued, demographic and/or anonymized data, matters of public health, etc) can be made, but use of non-excepted data requires consent by the owner.
A person can rent (or otherwise permit) the use of their data for a time, but can never surrender ownership of it. Permission to use personal data may be revoked, and does not include the right to to sell or distribute it.
All non-permitted data must be turned over to the person (or their legally designated custodian) or destroyed. Revenues generated by illegal use of a persons data represent theft from that person.