Steep fines for “each” occurrence. You can most definitely deter all but the dumbest companies from trafficking in toxic data.

Are you going to buy shares in a company who’s entire worth is derived by it’s user data when it turns out that a significant but unknown amount of that user data is actually a very expensive liability?

There’s always going to be someone searching for loopholes, like anything, so keep it unambiguous and straightforward.