You don't need to mandate the solution, just punish the negative outcomes. As long as Experian and their peers can get away with dumping gigabytes of data without any punishment, they will. Apply a generous fine to any data breach or an incident resulting in monetary loss incurred due to bad software, and you'll see things change.