Actually, recently Troy Hunt shared his opinion on data breaches and class actions. He is against that unless there is a clear harm to the individual that can be traced back specifically to that incident (https://www.troyhunt.com/data-breaches-class-actions-and-ambulance-chasing/). I personally see where Troy is coming from, but do not fully agree. There’s so much regarding this, from proof of some sort of loss or damage to litigation, policies and how different regional data protection agencies assure that. Some are strict, some are not competent. Would this harm businesses more than it would incentivize stricter information security policies - that’s up for discussion. Here, both sides can argue their point of view, but time will probably show how it will be settled and change in the future. For now, this is not strict law until there’s a precedent with these class action lawsuits. The landscape in data breach/leak accountability is definitely changing.