I think part of the challenge is actually showing damage after an information breach. It can be difficult to connect a particular breach to a particular harm: t

I think part of the challenge is actually showing damage after an information breach. It can be difficult to connect a particular breach to a particular harm: the harms are often hidden until much later, at which point the same data may have been contained in several more hacks. We need an avenue of recourse that doesn't rely on showing actual damages if we want to address the current market failure.