Just about every other industrialized country has a national agency with the job of protecting personal data privacy. While that model might not work in the U.S., the CTO should prioritize working (along with the FTC) to investigate privacy risks, set standards, and educate the public and policymakers.