Agree with this. An insurance requirement would solve this problem. It would also incentivize robust security audits by the insurance companies and the data collectors.