system
Given the following post, respond as if you're commenting on Reddit:
human
CMV: The US Federal Government should institute a framework for fiscal punishment of organizations that have data breaches

The United States has a debt problem and a data security problem that I believe have a mutually beneficial solution: severe financial ramifications for companies and institutions that have data breaches. We have a systemic reoccurrence of data breaches across all sectors in the US and organizations and companies face no serious consequences for their indiscretions. Class action lawsuits ultimately amount to a slap on the wrist and offer no tangible benefits to customers whose data was stolen.  

Large fines for corporations that have data breaches would increase interest in data security as a deterrent to avoid fines. It would also provide a revenue source to offset the federal deficit when fines are levied. The goal would be to reduce breaches which would eventually also reduce federal income from fines if companies took this seriously, but that is a good thing.  

Here is an example: T-Mobile is currently facing a class action lawsuit for a 70+ million customer record breach. That lawsuit will drag out for years and customers who were affected will ultimately get a fat check for $2.50 while the lawyers will get a third of the settlement. No real tangible benefit to consumers, no serious ramifications to t-mobile, and data breaches continue. If the fine from the federal government was something like $700m it would be a serious deterrent to allowing data breaches in the future. Garnish T-mobiles profits. Make some money.  

The same principle could apply to non-revenue generating organizations or institutions by reducing federal funding where applicable.  

I’m tired of sitting by and watching while our data is pilfered and not taken seriously by businesses we interact with. We as citizens have no recourse. This would provide serious consequences for lack of action and ultimately foster an information security mindset in the United States that has been lagging behind the past few years.
gpt
There's 2 problems with your system. 

1. There's no way to ensure you'll never have a data breach, no matter how good the security it can be cracked, smaller companies that can only afford moderate security will be fucked. Just becaues there's a data breach doesn't mean the security was negligent. 

2. This will further incentivize companies to just not report data breaches and cover them up instead which is already a massive problem. 

If your policy stipulated that they had to be particularly negligent in their security and further penalties for trying to cover up a data breach then maybe it could work.