I like the idea of personal data regulation, but I can't imagine it being easy to enforce, when data can be passed with complete ease and without any detection when compared to moving expensive physical goods.

The big problem right now is that Cambridge Analytica/Facebook are about to set a precedent for large-scale data misuse by receiving little to no punishment. In a fair world you'd be right, and regulation would exist to give Facebook and co a big enough fine for their breach of trust to ensure that no one ever does this again.