While in this collective pipe dream, why not just make it a felony to have unauthorized possession or transmission of this data, make sentencing gravity based on attributes like unsecured, breached, willfully sold, etc?
Could be paid to the person instead of the government
Would be nice, but wouldn't that limit the taxable set of data records to those that have enough info to route payment to? Either paid directly by the company, or enough information for the government to identify you.