I don’t think the idea is to “make it hurt” so much as to make compliance more affordable than non-compliance. If the “right” response to a data breach is also

I don’t think the idea is to “make it hurt” so much as to make compliance more affordable than non-compliance. If the “right” response to a data breach is also the most cost effective then it’s infinitely more likely that a business will pursue the right response. Unfortunately, the right response is most often the most expensive and so is actively avoided by management because, at the moment at least, sweeping it under the rug and keeping your mouth shut is free and only a tiny bit of a gamble that someone finds out.