Laws, and more specifically their penalties, are precisely for fixing incentives. It's just a matter of setting a penalty that outweighs the natural incentive you want to override. e.g., Is it more expensive to respect privacy, or pay the fine for not doing so? PII could, and should, be made radioactive by privacy regulations and their associated penalties.
It's not a complete fix but I'm sure a law with teeth can make a big difference. There's a big difference in being data mined by a big corp with the law on its side and a criminal organisation or their customers that has to cover their tracks to not get multi million dollar fines.