There are two separate infractions here that shouldn't be conflated: allowing a data breach to occur, and failing to disclose a breach. As far as I can tell, t

There are two separate infractions here that shouldn't be conflated: allowing a data breach to occur, and failing to disclose a breach. As far as I can tell, the perverse incentive you're describing is that the if the penalty for a breach occurring is too harsh, it could lead companies to cover up a breach rather than disclose it. A penalty for failing to disclose a breach would be meant to discourage that, and I don't see how that penalty is itself a perverse incentive. The penalty for a data breach must be harsh enough that it would cost a company more than it would to guard against it. I don't believe that there exists a penalty that satisfies that condition yet is also light enough that a company wouldn't cover up any breaches that occurred.