I don't see it as fair to say those are consequences of the companies being allowed to have the data in the first place. They're consequences of poor security.

I don't see it as fair to say those are consequences of the companies being allowed to have the data in the first place. They're consequences of poor security. We don't blame spam on email or food poisoning on food, do we? A GDPR-like approach to solving spam would be outlawing all automated or business-related use of email.