In Australia, I'm happy to say all I need to do is report a data leak to the privacy commissioner and they'll basically investigate what's happening and force changes.