> If you spend an absolute fortune protecting someone's named and address combination, that will be paid for by the customer. And then you get your lunch eaten

> If you spend an absolute fortune protecting someone's named and address combination, that will be paid for by the customer. And then you get your lunch eaten by a competitor who understands that the PII is unnecessary for the business relationship. But only if that externality is actually accounted for in regulation.