Shift liability to those who store and sell data. They get full economic responsibility for fallout of breaches of data that is retained past the time necessary to complete the transactions. If they sell the data then they hold liability for all breaches of downstream parties as well. Require them to carry insurance against breaches.

It would completely destroy the data brokers and targeted ad industry but the world would be a better place as a result. Also not going to happen but I can dream.