Difficulty there is that many vendors are victims of data breaches, so they perhaps don't deserve to be demonized quite as much as if they'd outright sold the data. Could be difficult to prove which side of Hanlon's Razor they fall on.
It would be important to stress it out on the page that it may be due to security negligence/failure rather that just data sale.
I’m working on something I call “datapoint tax”
Make this hoarding of data a (tax) liability. A policy like this will solve most problems.