It’s already been set in other industries, the financial industry springs to mind.
Everybody in a bank is responsible for detecting and preventing money laundering. Failure to report money laundering if you suspect it is a criminal offence (this is true in the UK, I assume similar laws exist in the US). If your boss refuses to acknowledge your report, then you’re obligated to whistle blow.
There is no reason why a similar framework can’t exist elsewhere. A requirement that engineers report abuses of data, or corrupt behaviour, and an obligation to whistle blow of management refuse to acknowledge the issue.
These laws of-course place a heavy burden on C-suite execs, making it clear they can be held criminally liable for the misbehaviour of their organisation, even if they weren’t aware of. The simple act of not being aware of criminal behaviour is criminal.