GDPR prevents this by putting rules in place that you, as the owner of the data, need to show that you're protecting it responsibly.

The threat of the gigantic fine is what gets people into compliance to prevent this from happening.

Lots, possibly even the majority of companies in Europe beefed up their IT security procedures because of this, and I wouldn't be surprised if almost everyone that sits at a keyboard in Europe didn't get called into a meeting to talk about how important it is for them to keep their customer's data private and ways to do that.

Without something like this in place, companies can just not even care about users data.. because 'oops, we did nothing to protect it' is still a valid excuse.