Congress should take action, and install a watchdog that continuously monitors these companies; e.g. by verifying that data placed online cannot be bought through different channels.
That isnt going to happen under the current deregulatory administration.
it's unlikely to happen in any administration. proactive monitoring is cost prohibitive compared to reactive punishment and a legal framework for doing so. as you said, the latter is unlikely to be meaningfully strengthened.
fines and enforcement must present a significantly larger liability than profit opportunity for any real changes to ever take place. else it's just written down as another expense of doing business as usual.