There are lots of companies that take security seriously and don’t lose their customers data. Which is good, because there are companies that need to hold customer data.

Companies that don’t take security seriously and lose peoples data should be punished accordingly.

Companies that sell customers data should be identified.

But if we treat them all the same, then we let the bad companies off the hook, and punish the responsible companies unfairly.