Yes.
When there is a data breach it is important that not only the users be notified. There also has to be an analysis. However, an analysis can sometimes mean that police services or government or organizations will be investigating the incident and identifying the causes, whether they be technological causes or a lack of procedural diligence.
The goal is not necessarily to punish those who are responsible but rather to learn from the incident. We have to make sure that as a government and a society we are moving towards better practices, the most effective practices.