This is a bad idea; it just raises the cost of entry for startups unnecessarily. Liability should be in proportion to harm actually done, and harm actually done

This is a bad idea; it just raises the cost of entry for startups unnecessarily. Liability should be in proportion to harm actually done, and harm actually done is in proportion to how much personal data is compromised.