It would be like fining the victim of home burglary who stores data about their neighbors for profit. Mandatory business data leak should be exempt but everythi

It would be like fining the victim of home burglary who stores data about their neighbors for profit. Mandatory business data leak should be exempt but everything else should be a liability. If they save cc info by default (opt-out) that should be a major liability.