Jail is a bit much, but I do think corporations should be financially accountable for the clean-up of privacy spills. (E.g., similar to environmental disasters.)

If corporations face the prospect of a big bill, and the cost of that bill far exceeds the cost of keeping user data safe, a lot of the right things will start happen.