A big problem with slapping huge statutory damages / fines onto data breaches is that only the "suckers" will ever pay or even own up to it. Recently in Washin

A big problem with slapping huge statutory damages / fines onto data breaches is that only the "suckers" will ever pay or even own up to it. Recently in Washington State, a small research group at WSU lost a couple of hard drives that had PII data on them on order of 1 M people. They even had them in a safe; the safe was stolen and no real evidence of the data being the target of the theft was found. Nonetheless, being good civil servants they scrupulously reported what happened and carried out required notification procedures to the million folks. Their reward was to be sued for basically the maximum that their insurance would pay out. How many thousands of times per year do similar things happen in private industry? Nobody knows. You don't even have to posit malice or a coverup; just think about how many times a year a hard drive backup of a database with a mere million records gets accidentally thrown away or sold off with surplus.