The sad fact is that most companies aren't even implementing basic controls that everyone knew were important 10 years ago. If you look at a lot of the high profile breaches, they're due to fundamental stuff, not a lack of super high end ultra-expensive security appliances. Its something consumers reasonably expect companies to be doing, but they aren't doing.
I believe it is possible to have companies manage things and have good security. You could accomplish this by having individual consumers take more responsibility for their information, but its more likely and more effective that "we" would take more responsibility for our information through market pressure, standards, etc.
The most likely form for this to take right now is through standards and compliance. The improvements in the situation are being driven by this now. We're not there yet, but its improving.
The area where I do agree, though, is that it will be difficult to have effective security and privacy without legal support. The government is completely full of shit when it comes to information security, as they are full of shit when it comes to so many things. The NSA's efforts to compromise encryption and product security are a great example of this.
On the other hand there are laws like HIPAA. HIPAA is so vague, and yet it has been effective in driving change in the healthcare industry. Again we're not, "there" yet, but things are changing at a relatively rapid pace. HIPAA is actually a good example of where the government was not overly prescriptive, but does enforce substantive penalties for noncompliance with very general common sense requirements. On the other hand you have industry regs like PCI which are extremely prescriptive and have had a similar effect. Consequences are the only reason why PCI is having an effect as well...