The "fall guy" problem strikes me as nontrivial. Even if you add to the law that the CEO always has liability for any data leak, a sufficiently well capitalized company run by someone aware of the liability would simply create a shell company that owns all of that data. You could disallow company transmission of said data at all but that is going to cause problems when trying to actually verify said information . . .