Yeah I've long said we should treat data leaks like food safety. The only way we'll see software security improve is if there were serious fines and/or jail time for leaking user data due to negligence.
I would like to see restricted access to only us workers for us citizens data though.
Transferring us customer data outside the country should be illegal