Exactly. There is currently no meaningful penalty when a company fails to protect private data or violates its own privacy policies, so of course they continue

Exactly. There is currently no meaningful penalty when a company fails to protect private data or violates its own privacy policies, so of course they continue to do these things because each either makes them more money or costs them less money. Prison time being on the table for officers of the corporation is the only thing that will change this behavior.