[pfranz]

> I think this would have a negative effect.

How? Disclosure should already be legally required--class-actions and lawsuits should already be a thing. The Have I Been Pwned data sets aren't volunteered by these companies. It's a catalog of leaked data.

The class-action response of "identity monitoring" is nonsense. More companies, if they can't afford to or don't want secure data, shouldn't collect it or should aggressively purge it. User data should be a liability.

[freeopinion]

Amen. User data should be a liability. The incentive should be avoiding data collection.