I think people are disinclined to prosecute because the odds are stacked against them.

I'm thinking of an analogy, and I've mentioned this before in other threads. The concept of statutory damages, as I'm thinking of it, is that a certain level of damages are automatically awarded. For instance this is used for figuring out damages when songs are copied illegally. It eliminates the need to construct a unique legal theory and case for each and every instance. In this case it benefits the record companies, which is of course controversial, but something like it could also benefit consumers.

If a company is found to possess your data, they automatically pay you X dollars, enough to make it a deterrent. You sign up with a law form that specializes in these cases, and they get a share of the damages.