Without data provenance (ie a data chain of custody) corporations will just "subcontract" it out to the lowest bidder. There needs to be consequences all the way up the chain to everybody that provided the data. This way, the people will bad security won't even get the data in the first place because no one will risk their data with them.