Problem is, on what basis is a person's "private data" worth $100,000, or will the exposure thereof cause damages of $100,000? The average person's entire net worth is only a fraction of that.

There is such a thing as punitive damages but in most civil cases a company or individual is not going to be held liable for more than actual damages.