Liable how? And to what extent, the idea "let the companies be liable for their own data breaches." sounds good until you think about for more than 10 seconds

Liable how? And to what extent, the idea "let the companies be liable for their own data breaches." sounds good until you think about for more than 10 seconds. Identity Fraud is not normally carried out using just 1 breach, so it is several breaches combined that give a criminal what they need to commit full Identity fraud. Credit Card Fraud can almost never be traced back to a single breach. Are you holding the company that collected the data, or the company that the data was stolen from liable, often times these are not the same entities. I can probably come up with about 1000 other things to bring up in relation to "let the companies be liable for their own data breaches."