Government-led heavy-handed oversight is so terrible that it also gave us rivers free of coal sludge, products that work as advertised, drugs that have to be tested before they are sold, airplanes that usually don't crash, and cars that are safer, more fuel efficient, and cleaner then they were before mandated seat belts, air bags, emission limits, and mileage gains.
At this point, the nuclear option, like the GDPR, is the only way to align the interests of large data firms with the public.
If you think otherwise, consider how the market punished Equifax for their data breaches. Or Kaiser. Or Target. Or Facebook.
When given the choice between doing the right thing, and the expedient thing, this industry has a long, and shitty track record of always choosing the expedient thing.