The answer is both things. Legislation should forbid misuse of data with company officers being personally liable in the same manner as Sarbanes-Oxley, and should be so strictly enforced that holding data about individuals becomes seen as a liability instead of an asset.