I find that particularly unrealistic that we can arrive at a good place solely by fining companies for data breaches.

Seems to mostly work in Europe. Did you know that a European person's advertising tracking data is the most expensive because it's so hard to get?