Just have it so that any time a person or company's data is sold or leased, the company doing the selling must mail (via physical correspondence) the person or company with a notification of what data was sent and why.

People will get tired of the junk mail and companies will lose money trying to peddle data.