"Evil" is subjective and too broad (most of it has already been outlawed anyway and that works: e.g. a competing business is going to think twice before DDoSing you as they know they are doomed if that gets discovered and proven). Surveillance, however, is a much more specific thing. Stalking people already is illegal for people, it should also be made illegal for companies.