It's a multi-faceted issue. It requires action by a number of actors. Not that long ago, there was an important impetus for advice to individual consumers: Be careful; do not put too much information on the Internet; use strong passwords.
That's all very true. People should be prudent. They should use rigorous passwords. However, I think it would be wrong to put too much responsibility on individual consumers in protecting their data.