So far, there really hasn't been a good set of guidelines that companies holding our data could be held accountable to and asked to follow.
Companies with access to our private data were left to their own devices when it came to treating that data - with predictable consequences to our privacy.