If its such a long shot I would be very happy with simpler laws that just address those issue. Let say: If data a company collects about a person end up being

If its such a long shot I would be very happy with simpler laws that just address those issue. Let say: If data a company collects about a person end up being used by scummy call centers or data identity theft, then any victim should have the right to compensation equal to 10x of any monetary losses, and for every 100 victims the legal person responsible at the company that authorized the data collection should get 1 year in prison. No consent needed, no exceptions allowed. Just simple damages and jail time. Sadly laws are not written like that and companies would not want to exist with such sword hanging above them, so we end up with laws like gdpr that tries to have enough threats to push companies in the right direction, with mixed results.