Your analogy is a bit off. Companies have responsibilities to keep customer data safe - Medibank wouldn't be fined if so someone broke into their offices and stole all the toilet paper.