Maybe you're right, but in the real world I'm already getting multiple letters a year from companies that have my PII and have had an unexpected breach. The iss

Maybe you're right, but in the real world I'm already getting multiple letters a year from companies that have my PII and have had an unexpected breach. The issue isn't policy, it's implementation.