Bad PR works to an extent, but bad PR can be combatted with good PR, not necessarily with changes. I think an independent regulator would be useful; one that can testify that a company is following best practices for data, etc. Although if the regulators don't have any teeth, or if they don't have a clear benefit for companies to allow a regular, comprehensive, internal audit, it definitely won't gain any adoption.