You don’t need surveillance, if anything that just opens up an avenue for espionage. What you need is AUDITS. Audits fucking suck but they keep everyone accountable. You back up your auditors with strong penalties and clear guidelines and you’re good.
No spending should occur without an auditing plan on how to ensure you’re getting what you paid for.
We need chain of custody data laws. If FB sells your data they’re responsible for keeping a chain of custody as to who they sold it to and requests for removal need to follow that chain down with regular audits and stiff fines for noncompliance.