This is a symptom of broken legislation. The fines should be high enough that securing the data in the first place should always be cheaper than paying a fine in case of breach (the fact that not all breaches are noticed or reported should also be accounted for when determining the amount).
1 Like