A store sold its old servers, and the disks were sold with customers' personal data which is now being used to harm those customers.

The obvious way to try to prevent repetition of this specific problem is with a law about disposal of servers' disks.

The deeper way to fix this and many other problems caused by stores' personal data is not to allow stores to collect any. Stores should not be allowed to track their customers.