That would be fair, but frankly as a user that gets the spam - I don't care. The damage to me is pretty much the same.

It would be important to stress it out on the page that it may be due to security negligence/failure rather that just data sale.

As a matter of fact.. they lost or gave away your info. They should reimburse you for that.

I’m working on something I call “datapoint tax”

Make this hoarding of data a (tax) liability. A policy like this will solve most problems.

If a company has a data breach, they most likely still have a security problem. While they may actually be victims if any 3d party software is exploited, it still comes down to system misconfiguration inany cases. And that would still be their fault.

That should depend on whether they informed the affected customers that their data was leaked in a breach or (if they weren't yet aware of the breach) how they react to the news that they have been breached.

I don't really care all that much if they sold it or lost it: they had it and were not good stewards of my data. That's all that I want to know.

You could argue that without painful consequences for breaches, companies will not care about preventing them from happening.