if I was a parking garage that made money by keeping my clients car and 1) other similar companies did the same and had their cars stolen over and over again (s

if I was a parking garage that made money by keeping my clients car and 1) other similar companies did the same and had their cars stolen over and over again (so I know it is likely or at least possible) and 2) thieves killed hundreds of people by using the stolen cars and 3) I didn’t provide any sort of damage reparation to my clients then: yes. Or, how about they explicitly tell their customers that they can’t keep their data safe and might be a target of an attack that harms the customer? I’m ok with either option. There is an implicit expectation/contract that if a company is collecting your data it will keep it safe. If it’s not going to do that and will not do anything afterwards to repair any damages caused then they should just delete it after using that data or, advertise they can’t keep it safe and let the customer decide.