You are in essence looking for GDPR. It calls for huge fines in case of violations and thus should ideally enforce strong security standards.