My belief is that this is why we need a law saying no use of user information for any commercial purposes. With draconian penalties assessed per user-incident.

Bonus points awarded for legislation that pierces the veil.

So you want to play games and you "leaked" a million user records to your business partner? That's a million fines slick.

Oh, you "leaked" them to your business partner again the next week? No problem tough guy, that's a million more draconian fines.

We can play this game all the way to your bankruptcy pal.

We need to stop these tech companies from trampling privacy and the only way to do it is to hit them extremely hard where it hurts.