Require companies that store that kind of data to carry insurance that can make anyone damaged by the data collection (and leaks of said data) whole. And the 'make whole' amount definitely needs to be individually defined. You shouldn't get away with paying a little fine of a couple thousand USD if your data leak causes me millions in damages; In that case, you owe me those millions back.