You don't see the risk of fines as an incentive for companies to keep data secure in the first place, or not keep it at all?

I'm curious: Do you know of any cases of the scenario you described actually happening?