> I'm just opposed to the idea that any amount of caution on their part should dissipate their (or their insurer's) legal liability in the event of a breach.

Oh then yes we totally agree. If they're prudent, their insurer pays. Otherwise they do.

You might be right about the credit reference industry being ultimately unprofitable as a standalone business, but I think there's a lot of arguing to be had about the magnitude of those externalities. That's why we need a law to provide some automatic, per-individual-leaked fine - the insurable risk from way up-thread.