I would like to talk about another aspect relating to what Professor Geist mentioned.
This also imposes a kind of penalty on companies that are more considerate about protecting our privacy. In fact, the companies that are the most open and that will inform more people if they encounter a privacy-related problem will see their reputation pay the price.
Those companies that take a chance and try to hide things or who see the situation and decide to do nothing, it is always possible that no one will know that there was a problem or a breach. That isn't the situation we should create. We need to have minimum standards so that everyone knows what their level of behaviour should be.