Asset vs. Liability
The root of the problem is that businesses see personal data as an asset; the more they have, the more they can monetise it.
If there was legislation to make personal data a liability, something that costs you money, then businesses would think differently about it and try to minimise their holdings of personal data.
So if businesses had to pay a levy of one pound per year for every row of personal data in every database they have then they would work to minimise that cost; they'd clean out personal data relating to old accounts as fast as possible, they'd think hard about the actual value of personal data to them. At the moment they keep as much as possible because "it's an asset".
The levy could be used to finance the enforcement of data protection and for compensating victims of data theft.