Of course there is an argument but it doesn't square with torts law in most states, at present. The main reason is that it is too hard to establish whatever har

Of course there is an argument but it doesn't square with torts law in most states, at present. The main reason is that it is too hard to establish whatever harm you claim occurred is proximately caused by the breach. A more practical reason is that the harm provably caused is typically of minimal value, and the harm is of such a varied nature, that class actions never get certified for breaches, with a few exceptions like Equifax. Individual cases can of course proceed, but it's rare for the harm to be great enough to make legal fees worthwhile.