This exactly. Data ought to be viewed as fissile material. That is, potentially very powerful, but extremely risky to store for long periods. Imposing severe penalties is the only way to attain this, as the current slap on the wrist/offer ID theft/credit monitoring is an absurd slap in the face to consumers as we are inundated with new and better scams from better equipped scammers everyday.

The current state is clearly broken and unsustainable, but good luck getting any significant penalties through legislation with a far-right government.

Yeah, take an externality, make it priceable, and then "the market" and amoral corporations will start reacting.

Same principle as fines for hard-to-localize pollution.

All of these claims for serious fines, yet no indication of where the fine is to be paid. Fines means the gov't is getting the money, yet the person whose data was lost still gets nothing. Why does the person that was actually harmed get nothing while the gov't who did nothing gets everything?

Even better - give the customer the $10k.