I absolutely think that you can and should make contracts that provide for restitution, if possible. It's up to each individual what sort of restitution they would require for leaking certain pieces of their data.