Using the threat of GDPR enforcement to ratchet up ransomware payouts ... entirely logical. The only solution is for enterprises to figure out how to get secure. I remember the anti-spam market of the early 2000's, when controlling spam seemed similarly hopeless. Can we turn a corner here as well?

Just remember that a federal law will need more than pre-emption. It's going to also make the industry uncomfortable. The industry is will wiling to give on transparency, but that's only half of what's on the table.