Possession of the data should be illegal. It can be enforced through statutory damages, similar to the damages paid for sharing copyrighted music recordings and movies.

Just make PII copyright of the person it identifies, similar to how a "likeness" is owned by a person.

Then sue for copyright infringement.

Then all the five page long boilerplate contracts for every service you use are just going to add another clause saying that they get an irrevocable, transferable license to the data they collect. Probably without telling you because there's already a clause saying they're allowed to change the contract without notice.

Regulations can and often do supersede contract clauses.

Sure, but unless the data is given some special new kind of copyright that can't be licensed or whatever, that wouldn't. Copyright just isn't the right tool for this job.