I don't think regulation is necessarily required, but I think consequences are... and serious ones at that. Data misuse and "oopies" data breaches by shady companies that were about to go out of business are actions that should be seen as malicious and come with serious penalties. Judges aren't the best at tech stuff but if they're lacking we (techy people) should help inform guidelines and let the justice system do its job here.