Then those companies need to take out very expensive insurance policies that protect the individuals whose data they must hold. If they can't afford that then they can find a new line of business.