Yes, legislation is the first step. They made it illegal to access certain data with the CFAA, there's no reason illegally accessing data of a person can't be legislated too. Well, except for "businesses should be allowed to do anything they want."