Company A sell data to party B. Party B resells the data to party C, D, F without informing company A. Company A & B are owned by the same conglomerate.

Your law as written would only cover company A doing the sale of data to B, but not the downstream intermediaries.

Alternatively, company A doesn't sell the raw data, and instead sells reports and anonymized data that can easily be joined with other datasets. As this is not a sale of "user data", but an aggregated, anonymous insight.