Earlier quoted context omitted.
Is there any instance of (a) a SaaS with a legally binding contract with some teeth around user privacy and (b) where that clause was exercised and the user benefited? The civil route be an alternative to regulatory solutions.
Regulation doesn't make the social change. Software does.
For traffic accidents, there might be various applications of lawsuits, citations, and speed bumps in your town.
In the case of SaaS, we might have only one or two. For example, take LinkedIn last week, selling everyone's PII to ScribD. There might be legal issue in GDPR or CA jurisdictions. There's probably no civil one (?). There is certainly no tech one: you need your PII to be on LI so your friends can find you, because that's the value of LI. I suppose in there future there could be a tech solution here with agents representing you in the cloud, or maybe e2e homomorphic encryption, but it's surely not what drives LI's income at the moment.