Because it has been established by precedent as a reasonable "consideration" for the limited harm of losing your personal data. (You don't have actual damages u

Because it has been established by precedent as a reasonable "consideration" for the limited harm of losing your personal data. (You don't have actual damages until your identity is stolen, not just your information.) It's meant to show that they didn't do nothing, without having to do anything more expensive. It's the minimum they think they can get away with.