Laws, and more specifically their penalties, are precisely for fixing incentives. It's just a matter of setting a penalty that outweighs the natural incentive you want to override. e.g., Is it more expensive to respect privacy, or pay the fine for not doing so? PII could, and should, be made radioactive by privacy regulations and their associated penalties.