Or even better; by federal law, cancel all bonuses, stock buyback and dividend for 3 years, for any company that leaked data about any person, anywhere in the world trough a data breach. And fine them accordingly, so the saved money don't just pile up for a late pack-back 3 years later.
That should fix the problem.