Hiding behind bankruptcy only works if the subsidiary has no assets. Patent trolls work this to their advantage by creating a company whose only asset is the patent. If they lose / the patent is invalidated the company's only asset is worthless. They therefore have no assets to pay their debts.

That's not how bankruptcy works. Assets are used to pay debts including legal debts.

The insurer.

Whichever party the consumer gave the info too. If X gets fined then it's their job to sue someone else if they think that someone else is responsible.

For the big credit agencies, how do you tell where the info came from? If you pay your rent and you make payments on a credit card both entities may file a credit report including your SSN, name, address, etc... If the credit agency loses track of their database, how do you determine which submitter should be responsible?

It makes more sense to assign all the blame on whatever entity lost control of the data. They get a big fine and as long as they were following best practices (as outlined by their insurance company), then their insurance company will pay the fine and the business keeps chugging along.

If the company was negligent, the fine is likely a death sentence.

Hold the directors and/or executive team personally responsible if the company folds without paying?