Or, you know, simply fine companies that have data breaches. They will figure out how to secure their systems on their own if sufficiently motivated. No need for heavy handed bureaucracy and red tape.