Commenting on my own post, I should expand a bit on "statutory damages." I got the idea from the music industry, where there are automatic civil damages for cop

Commenting on my own post, I should expand a bit on "statutory damages." I got the idea from the music industry, where there are automatic civil damages for copying recordings. If you're caught, you get to pay X dollars per item. This means the police don't get involved. The only thing you need is a tort lawyer willing to take a share of the damages. Also, a data breach is proof that you possessed the data. A business wouldn't be able to reduce their liability exposure to zero, but to an acceptably low level, for instance by actively erasing the data before a breach can occur.