If we consider the consequences of sloppy and/or outright malicious data handling to be negative externalities foisted on society; then removing such externalities by law is pretty much fair game in my opinion.

Especially taking into account that there might not be a linear relationship between the damage accrued by society versus the costs of the company to ameliorate such damage.