I'd say I generally agree that the privacy problem has no techno-fix and must be solved by regulation.

For example, we could extend HIPAA-style fines for leaked personal data to other forms of intimate data like location, biometrics, local documents, private chats, etc.

Leak someone's location history? That'll be one $$$ fine per incident where an incident is one person data point.

This at the very least converts this kind of data from an asset into a potential liability, incentivizing companies to not collect it, not hold it long, or thoroughly anonymize and aggregate it and then discard specifics.