We don't fine them, but homeowners usually don't have million of records of private data at home.

Wouldn't you want your bank get fined if they aren't secure enough and loose your money? Or your local government if they loose your tax records because they think they don't need to lock their door?

The hard part will be determining whether the company could have done something about it (like locking the doors or the windows). If they could, they for sure should get a fine if they didn't.

We absolutely do fine/convict homeowners if, in a burglary, their improperly secured gun is stolen. The fines aren't for being hacked, they're for not adequately securing user data; ownership of which is a conscious decision.

It would be like fining the victim of home burglary who stores data about their neighbors for profit. Mandatory business data leak should be exempt but everything else should be a liability. If they save cc info by default (opt-out) that should be a major liability.

> We don’t fine homeowners who fit cheap locks and get burgled do we

This isn't an appropriate comparison. I'm not a lawyer but I would imagine this would fall under negligence. Businesses are liable for improperly securing dangerous materials in the physical world.

> We don’t fine homeowners who fit cheap locks and get burgled do we.

The type of locks you have affect the price of your home insurance, in the UK at least.