What we need are large, mandatory, fines for every data breach that happens. Say $10k to every person whose address gets leaked. Then we'll see companies start treating consumer data as a risk, not just a low -cost asset.