I would make it even simpler. If a company is breached and customer data is stolen, the company is liable as a coconspirator via negligence to any resulting fra

I would make it even simpler. If a company is breached and customer data is stolen, the company is liable as a coconspirator via negligence to any resulting fraud or scam claims on affected customers. They may make an affirmative defense that the scam was not due to their breach, if they can prove their leaked data was not used. > Also make it so credit agencies knowingly reporting incorrect information is a crime, and make them liable for all costs incurred (higher interest rates) and financial penalties for extreme cases (refusing loans outright, refusing rental, demanding higher deposits, etc). This is already a thing, under US libel laws. Not 100% sure about the damages and how they would be calculated, but they are liable. The underlying issue is that I'm doubtful they ever "knowingly" lie. They're basically information aggregators; other people report info to them and they republish it. They might suspect some entries of being unreliable, but I don't think they ever truly know. They live on probabilities. A second underlying issue is that the government has consistently exempted credit agencies from normal applications of libel. Presuming you aren't famous enough to be a public figure, under normal libel law you would only have to demonstrate that a) the information is incorrect (regardless of whether they think it's true or not), b) that they distributed it, and c) that it was written (spoken would be defamation instead of libel). If you are a public official or public figure, you would also have to show actual malice (intent to harm, or reckless disregard for the truth). The government (the judiciary, really) has consistently applied the malice standard to private citizens under the argument that the system provides substantial benefits to it's users (businesses) and that it effectively cannot exist with normal libel laws. The malice part effectively shields them from all claims. It's an incredibly high bar to reach, because it's also what protects newspapers from drowning in libel claims. So we're granting credit agencies reporting on private citizens the same protections as a newspaper reporting on the president. Any significant changes to credit agencies would need to start with rolling back their libel protections to some degree to make them actually liable for what they publish.