> If you spend an absolute fortune protecting someone's named and address combination, that will be paid for by the customer.

And then you get your lunch eaten by a competitor who understands that the PII is unnecessary for the business relationship.

But only if that externality is actually accounted for in regulation.