passing a law that makes it illegal to sell any of someone’s data

A nice thought, but how to enforce this law? How to prove they gave or sold data? It’s easy for them to hide/delete records of data transferred.