Companies will also need to have people, who will process the sensitive data, at some stage, of having it. That is what data non disclosure agreements are for. If the person brakes the rules, he is the one, who will have to pay for the damage. I am pretty sure, google has that covered. And going after every youtuber individually is time and money consuming.