I'm getting more and more to the feeling that there needs to be stronger penalties for misuse of data than stuff like the GDPR. I get emails to an old, legacy

I'm getting more and more to the feeling that there needs to be stronger penalties for misuse of data than stuff like the GDPR. I get emails to an old, legacy email address of mine. I haven't actively used it in like 15 years, and when I did use it, it was on gaming forums because remember the days where you didn't give your real contact details to every random person with a site on the internet? Anyway, this email has ended up in various people search databases for me which has then resulted in the likes of AWS recruiters, Druid salespeople, etc. emailing me on this address. I can see the path how this came to be: Gravatar Leak tied this email to newer email addresses I actually use -> various data brokers, probably buying off each other -> people search websites -> Amazon recruiting, Druid sales, etc. And now data from an illegal data breach has laundered its way into companies that consider themselves very serious about being law-abiding using that data. Unfortunately, the closer you get to the source, the less upstanding and more transient these companies are. The people search websites are kind of sketchy at times, the data brokers they buy from are more so, etc. So trying to get legal actions against the data brokers is kind of pointless, it feels. And this has real world effects. Recently a company which I was in the hiring process for decided midway to switch to emailing this legacy email address. Not any of the ones listed publicly with my real identity, not the one on linked where they claimed to have contacted me from, not the one we'd been conversing over for months, but one they'd plucked out of whatever people search DB they were using. Luckily I was aware of recruiters less-than-ideal handling of contact details, so I knew to check the ancient inbox when they went weirdly quiet in a way that was odd for that phase of the process. I think the only way to stop this is for there to be financial penalties on the end users of the ill-gotten data. When the druid salesperson emails me on the address obtained from the Gravatar data breach, there should be a fine for misuse of data, no matter how many layers of intermediaries there are between the Gravatar hackers and Imply Data, Inc. and the same story for when Amazon's recruiter does it. It's clear that anything less will not dissuade companies from the dissolution of responsibility for using ill-gotten data.