At the same time, I wouldn't want anyone to be able to enforce certain parts of that. For example, to make sure that data was only kept around as long as needed, you'd need to be able to monitor the contents of all the computers that contained that data. This creates problems of its own, much larger than the original one. To a certain extent, we just have to trust researchers with sensitive data, and severely punish gross violations of that trust.

To be honest, I've heard of many more examples of organizations who put too strict of controls on their data. This is due to researchers trying to walk a line between a requirement that they share their data, and their (understandable) desire to keep their work to themselves as long as possible, so other competing researchers can't publish on it first. A bad data governance committee fails much more often in allowing data contributors to be too strict with their data, even though I agree that a data breach is a worse outcome, and avoiding it should be the highest priority.