Ransomware actors could easily punish such legislation. By continuing ransomware attacks they would place many companies in an impossible situation, either break the law by paying or face imminent collapse.

How many jobs are you willing to lose in order to stop ransomware attacks?

One ransomware attack probably costs the ransomware operation a few thousand dollars, any legislation would have to be extremely successful to result in a negative ROI.