That said, statutory civil penalties (fines per occurrence) for the effects of the bug in production _would_ fix the problem. Who is going to keep giant data-lakes around when they are the business equivalent of toxic waste? The developers are still able to write code, but they are incentivized to not collect extraneous user data.
It's no different than requiring, e.g., farmers to limit how and when they apply fertilizer and pesticides so as to limit runoff and down stream pollution.
Do you want the high school kid in his bedroom to go to prison because he wrote a "site" and his friends data got leaked?