Unnecessarily cynical reading. If the nightclub was certified to have sufficient egress by the relevant qualified authorities, then that should be enough for the business owner to not have to worry about being liable for it.

Similarly, if a food truck uses a point of sale service, the food truck owner should not also have to be knowledgeable about evaluating the point of sale’s database security. Their job is to make food.

If the government wants to protect people’s data, then it should set the standards or certifications for the vendors (and/or go after the people who misuse the data), not lay that liability on the vendor’s customers.