> We need some sort of human right for digital privacy to make this sort of thing illegal.

This already exists in the EU, the EU charter of Fundamental Rights https://fra.europa.eu/en/eu-charter/article/7-respect-privat.... states "Everyone has the right to respect for his or her private and family life, home and communications", however it seems to have been ignored.