I want companies to be held liable for their breach, especially when they are negligence or easily avoidable. I currently have FREE CREDIT MONITORING as my PII

I want companies to be held liable for their breach, especially when they are negligence or easily avoidable. I currently have FREE CREDIT MONITORING as my PII has been exposed by multiple reputable companies plus the government. Monitoring x3 doesn't punish them for leaking my data. I doesn't even (in my mind) give them enough incentive to make it much harder to loose. I'd be happy if is was encrypted and regularly tested to make sure it was still encrypted, both at rest and in motion.