> A goldmine for social engineering.

Okay, I mean some medical studies collect data on millions of people, and those datasets too have the potential that, due to security arcana, can be data breached. Does that mean I should be able to sue all medical studies for collecting data on that potential? Of course I support some kind of penalties for data breaches, but you see that it something entirely different from, "data collection itself causes harm." You just can't show that...