Jack Karsten: How should the US legislate data privacy? (Brookings)