This aligns with something i heard a year or so at an "internet law" presentation. What with all the data breaches that have happened, proving that it was a particular data breach that let loose your private information is hard. Thus systemic harms accumulate, placing more burden on individuals to vigilant against identity theft, driving up other costs, etc.
This is also posted at http://elainegrey.dreamwidth.org/593666.html .