There has to be a finding of gross negligence. Shit is going to happen even if a company does it's best and follows all of the best practices. Under your rules

There has to be a finding of gross negligence. Shit is going to happen even if a company does it's best and follows all of the best practices. Under your rules and OS zero day, which the company has zero control over, could ruin them. A single employee fooled by an email could do the same. It's far too simplistic and heavy handed. Also, not all data is equal. For example, if someone gets my HN creds I really don't care. My bank on the other hand...