Yes, this approach assumes universal parity in the result of the act, which is far from true. For example the leaked health records of a healthy individual are not as damaging as those of someone with a lifelong condition, yet both cases are very, very bad.