Historically, these numbers have been $0.0+/-0. Executives aren't exactly bumbling around with hazardous materials.
https://www.schneier.com/blog/archives/2016/03/data_is_a_tox...
https://www.marketplace.org/2018/02/28/tech/sen-elizabeth-wa...
Equifax? Yahoo? Target? Heartland? TJX? eBay? JP Morgan Chase? Adult Friend Finder? Locationsmart and the cell phone carriers providing real time location information on all of their customers to third parties?
A CEO of a major corporation The Land of the Free™, wouldn't consider liability for negligent data handling very seriously given the government's seeming lack of interest in seriously prosecuting same. S/he'd probably even argue that investing more in security would lower profits and harm investors. And we can't have that.
What am I missing?
If I understand it correctly (IANAL), there are no penalties for getting hacked. Rather there are penalties for not having proper procedures for how to respond to a hack.
https://ico.org.uk/about-the-ico/news-and-events/news-and-bl...
> The data was taken from an underlying customer database that was part of TalkTalk’s acquisition of Tiscali’s UK operations in 2009. The data was accessed through an attack on three vulnerable webpages within the inherited infrastructure. TalkTalk failed to properly scan this infrastructure for possible threats and so was unaware the vulnerable pages existed or that they enabled access to a database that held customer information.
> TalkTalk was not aware that the installed version of the database software was outdated and no longer supported by the provider. The company said it did not know at the time that the software was affected by a bug – for which a fix was available. The bug allowed the attacker to bypass access restrictions. Had it been fixed, this would not have been possible.
Now that we have GDPR and the new data protection law ICO will be issuing fines under the new law.
This old case is an example of how the ICO regulate, and the things they'll take into account. GDPR wouldn't make much difference for this case.
Every corporation has to answer these questions but right now they have to do it with no real guidance from the government. This makes the data a ticking time bomb. It's not clear what can be done with it or even how much it's worth. It's not clear what best practices exist in terms of technologies and ethical guidelines.
That said nobody expects something like the GDPR too happen in America. Pretty much every other country will adopt similar laws though. If Americans are lucky they'll get some benefit from that.