This could be somewhat prevented if companies acquiring the data are legally barred from sharing it to other entities without getting a written statement from that entity that they have a secure mechanism to store and use it. Right now the company that did the shitty job is going to get a slap on the wrist at best. But the company that shared that data with this one is going free and even got to keep the money they got from this.