Which is why there should be legal mechanisms to place legal responsibility for decisions like this personally on those in leadership positions when they're being made, even if those people no longer hold those positions.
You bet your ass the chucklefucks who came up with this little stunt would've thought twice about it if they knew that there was a decent chance they'd go to prison for it.
Also gotta make this shit sting the shareholders too: make the company pay the victims not only the estimated value of their data but also a portion of all profits made while a policy like this is in effect. Since there's no easy way to tell how much money was made off their data, unless the company has the numbers, let's say half.
Suddenly the quarterly report's got a nice repayment shaped dent in its side and all the sudden the shareholders care about following the law and respecting the rights of customers.