Right: So what we need to do is make organizations liable for mishandling data.

Imagine if you could sue a company for disclosing your unique email address to spammers and scammers. (They claim it's the fault of their unscrupulous business partner? Then they can sue for damages in turn, not my problem.)

There are some practical issues to overcome with that vision... but I find it rather cathartic.