Perhaps regulation needs to move from mandatory disclosure when credit card/payment data is leaked/lost to mandatory disclosure when credential data is lost as

Perhaps regulation needs to move from mandatory disclosure when credit card/payment data is leaked/lost to mandatory disclosure when credential data is lost as well. This is already the case in the EU with the Data Protection Directive.