> The problem is that this isn't about saving money _overall_. It hasn't been shown to be otherwise either though. > companies that lose data don't pay any co

> The problem is that this isn't about saving money _overall_. It hasn't been shown to be otherwise either though. > companies that lose data don't pay any costs at all until afterwards Because we don't know what they should pay. We need reliable research that nails down how much a security breach costs society, and until have it, it's impossible to provide companies with the right incentives. Note that the cost should depend on the circumstances. For example, if Google or Facebook has a major breach, it would probably have a bigger impact (on a per-user basis) than a small service. If you just impose a uniform per-user cost for data breaches, then you're essentially giving larger services an unfair competitive advantage.