I've been suggesting that fines should be proportional to the type of data they request and how much. So the more you collect, the more you stand to lose in a

I've been suggesting that fines should be proportional to the type of data they request and how much. So the more you collect, the more you stand to lose in a data breach. That should do 2 things: 1) Encourage companies to do "least data collection" (a good thing) 2) Strengthen their security if they do any sort of non-trivial data collection