The U.S. has made a choice not to have any effective regulation of such things. Perhaps in another country, there are data security regulations with a regulato

The U.S. has made a choice not to have any effective regulation of such things. Perhaps in another country, there are data security regulations with a regulatory agency in charge and when you have such a breach, you get a call from the government which is annoyed with you. The regulator imposes some sort of fine, demands an action plan to fix the problem, and generally fixes things and reduces the chances of them happening again. The public, being satisfied that things are now fixed and realizing they weren't really harmed, declines to litigate. Or there's the U.S. model. Since there is no regulator fixing things, the only way of effecting change is to litigate. The regulatory role has been outsourced to the courts. Of course, the courts are poorly equipped to be regulators, but it's like using a hammer when you really need a wrench: you haven't GOT a wrench, so the hammer must make do. So the courts make do and in general it costs more and regulates worse than a proper regulator would, but hey: you haven't GOT a wrench.