This issue is my "abortion" issue. What I mean is, I don't care who the candidate is, how immoral or unlikable they are. If they run punishing companies for data leaks, I will vote for them instantly.
The root issue is that we are complacently pretending that any entity is capable of ensuring long-term security of a million-datapoint database of valuable information while at the same time thousands of their employees are allowed to work with it.
My old boss was working in this space a decade ago. Private data brokers you control, that companies would have to ask for info, pending your approval and such. As you might imagine in the era of sell everything you can, the idea never took off.
In a broker scenario, the company would access it as and when needed, on a permission basis. The cool thing about such a model is that if and when you move, change phone numbers, employment, etc, you'd only have to update it in one place! The last time I moved, I think I had to change it in about 20 places. Why does every company need to independently save my address?
Companies are just ideas that exist to help society run more smoothly, if one racks up enough penalties that it goes under, that’s good enough proof that it isn’t doing its job.