If I can recommend - although it is old, consider "Database Nation", as well as looking at the European Union's data privacy regulations and rules.

In America, we are the Wild Wild West. We have limited rights to our data, and no real rights to correction, amplification, modification or destruction. HIPAA isn't doing much, and the old Consumer Credit laws are showing lots of age. The various incarnations of Patriot Act style laws have not helped, and the simple fact that the Bush Administration wouldn't observe those is also concerning.