Again, I'm agreeing with Ms. Lawson, but also, in terms of dealing with the question of breach notice fatigue, I think it's possible to deal with that through the notification itself. If it's something that does not relate to...or where you're just being advised that something happened that may affect your personal information, it's different from, “Okay, you'd better cancel your credit cards and get new ID”, or things like that.
So I think it can be dealt with at that stage rather than just saying there's no obligation to report.