It'd be good if there was a law that'd fine corporations for being unable to protect user data.

Make the fine directly proportional to: number of people affected * bits of leaked data for each user.