Possession of the data should be illegal. It can be enforced through statutory damages, similar to the damages paid for sharing copyrighted music recordings and movies.