How about just jail time for owners, executives, and management of companies/organizations who collect and store this information to begin with? That's what we do for Peeping Toms outside people's windows. I don't see why something more creepy, more invasive, more permanent, and more harmful should be treated less seriously.