I can't say I'm at all surprised. I've had similar conversations in a non-advertising field with non-technical managers where their attitude basically boiled down to "What do we care?" when it came to problems that would cost someone else money.

I also can't see attitudes like that changing until companies that collect data are seriously held to account for any leaks/abuses of the data that they collect.

Potential penalties would probably have to include criminal charges, in much the same way that individuals and companies can be held criminally liable for mishandling toxic waste.