For example, I learned that in some states when a security breach occurs, the companies concerned notify the consumers and take it as an opportunity to give a marketing pitch. You know, “You've lost your data, and by the way, would you like another mortgage?”
On my preferred solution to this, the mandatory notification would be to the Privacy Commissioner, who would then make a judgment about whether the breach was significant enough for the notification of consumers to take place.