If they aren't responsible enough to handle the data, then they shouldn't have it in the first place. The end. Fine them out of existence if they hand over PII

If they aren't responsible enough to handle the data, then they shouldn't have it in the first place. The end. Fine them out of existence if they hand over PII to random 3rd parties.