In the EU this is the role of national data protection authorities. http://ec.europa.eu/justice/data-protection/bodies/authorities/eu/index_en.htm http://ec.eu

In the EU this is the role of national data protection authorities. http://ec.europa.eu/justice/data-protection/bodies/authorities/eu/index_en.htm http://ec.europa.eu/justice/data-protection/bodies/authoriti... e; well, not actually pen testing, but knowing what personal information companies store, and mandating minimum safekeeping measures and limits on sharing.