This is why it's very costly and time consuming to construct regulation that actually works. Crafting a set of rules that properly counter a system set up with incentives to do otherwise is pretty tricky.

I feel like it would be better if we could find a way to disincentivize companies from hanging on to your data. Maybe treating it as some kind of taxable asset.

This is one of several deceptive design patterns used by data brokers. Last year, we (the nonprofit consciousdigital.org) published a guide titled "How Deceptive Design is Used to Compromise Your Privacy and How to Fight Back". It contains 10 data protection deceptive patterns and countermeasures:

https://consciousdigital.org/wp-content/uploads/2023/04/dece...