There's a solution for this, which is relatively easy to implement, if we dare to. Recognize data privacy as a right. Enable the victim to sue the leaking party

There's a solution for this, which is relatively easy to implement, if we dare to. Recognize data privacy as a right. Enable the victim to sue the leaking party, with easy recovery and costs, for any bad subpoena accepted, and pay substantial fine for violating the rights. Very heavily substantial if it leads to subsequent other damage (such as stalking or violence). Miraculously, the data hoarders would find ways to verify subpoenas (and design protocols and pay for development of necessary tools) very quickly, I think. Of course, this would require such law to actually survive the lobbying block of the data hoarders in the first place, and that's not likely to happen, alas.