I'm trying to differentiate between data that is anonymized (cookies), and data that is not. I'm unaware of any data leak of anonymized data that resulted in any harm, but if I'm wrong I'd love to hear about it.
Well, Yahoo's publishing of supposedly "anonymized" data still poses a privacy risk to any of their users: https://www.vice.com/en/article/yp3d8v/yahoos-gigantic-anony...
That's just one of many apparently "anonymized" datasets that has been trivially deanonymized by researchers/hackers/internet-stalkers; so there's plenty of harm to be done.
I also can't see attitudes like that changing until companies that collect data are seriously held to account for any leaks/abuses of the data that they collect.
Potential penalties would probably have to include criminal charges, in much the same way that individuals and companies can be held criminally liable for mishandling toxic waste.