If a business cannot afford to properly handle and audit customer data then it should avoid any sort of collection. Businesses that produce value from customer data should be able to pay for necessary protections.