> There should be fines big enough to bankrupt the companies who fail to secure data this kind of data

...and then when their assets are broken up and sold off in bankruptcy, your sensitive data ends up scattered to random companies you never heard of.