Should we have laws to prevent profiting, selling, or quid pro quo of personal user data?

Should we have laws to prevent profiting, selling, or quid pro quo of personal user data?