The full sentence is this fwiw:

>Additionally, if a data breach occurs, the law permits consumers to recover up to $750 per incident (or actual damages, if greater).

So that might just be $750 as part of a punitive fee.

It sounds more like a statutory damages thing, although note I have not read the law.

The idea with statutory damages is that determining the actual damages can be difficult and uncertain, so some laws allow plaintiffs to elect to ask for damages from a standard range, and the court will decide where damages should fall in that range based. It's basically saying "just give me about what is typical for cases like this one".

Presumably it's a scale from

"Leaked (e-mail) adresses"

to

"Leaked nude photographs".

I don't mind my nude photographs. I mind if somebody takes loan in my name and dumb bank would send it to collections.

Someone else might mind your nudes. E.g. your employer, the school your kids go to, the parents of your kids' friends, etc.

At least in the US, rest of the world isn't that shocked of our natural form.

Presumambly the upper end of the scale would be closer to identity theft with total asset loss and fraudulent lines of debt, which is likely would occur if eg google got hacked.

It would be decided in a civil court, most likely.