Yes please! Making PII leaks an expense (like rent and cloud costs) means it's paid by the customer.
I strongly believe we should distinguish the price of doing the operation (aka rent) and the price of doing crime (ideally, jail).
I strongly believe we should distinguish the price of doing the operation (aka rent) and the price of doing crime (ideally, jail).
Before: customer pays fines for bad security, rolled into the price of the offering.
After: customer pays for actual good security, rolled into the price of the offering.
If the customer doesn't care, no change. If the customer cares (and let's low key assume PII is important) -- they see net gain from this change.
And then you get your lunch eaten by a competitor who understands that the PII is unnecessary for the business relationship.
But only if that externality is actually accounted for in regulation.