> I'm just opposed to the idea that any amount of caution on their part should dissipate their (or their insurer's) legal liability in the event of a breach.
Oh then yes we totally agree. If they're prudent, their insurer pays. Otherwise they do.
You might be right about the credit reference industry being ultimately unprofitable as a standalone business, but I think there's a lot of arguing to be had about the magnitude of those externalities. That's why we need a law to provide some automatic, per-individual-leaked fine - the insurable risk from way up-thread.
I do agree that would probably be a de facto ban on the industry, or at least a radical restructuring thereof. My suspicion is that the industry is actually not a profitable enterprise once all the externalities are properly accounted for. But I'd be happy to be proved wrong, and I'm more than willing to give the industry a chance to figure out a model that works.
Edit: Completely off topic, but this is the nicest internet argument I've had in a long time. Thanks, scrumper, for being an excellent debating partner!