Insurance data privacy & ethics - how far does the market need to go?

With the lack of a comprehensive U.S. Federal data privacy law means we are left with a patchwork of confusing and jurisdictional challenging state laws. Four states California, Colorado, Connecticut, Virginia, and Utah passed comprehensive consumer data privacy laws and twenty-seven other states have introduced and are in different stages of becoming law.
The concern and confusion come from the number of consumer rights and business obligations insurers must navigate, implement, and establish to comply with those new individual state laws and regulations.
A national insurer licensed and admitted offering multiline insurance products in all fifty states has consumer data in multiple locations across multiple jurisdictions in multiple systems in the cloud and on premises. With billions of records spanning decades, stored within outdated legacy systems including sales, quotes, underwriting, claims, and payment data makes complying with every state consumer right to access, restrict, op-out, delete a dauting task for even the most sophisticated compliance, IT and data science staff.