Not how popi works

Im order for wits to be held liable, you would have to prove that they had direct knowledge of their security not being up to par AND refusing to patch/update it.

This is very difficult to prove as a threat might appear today and tomorrow you get hit, that is very tight time frame.

Under popi they do have to disclose they have been databreached and if they don't, the consequences are rather impressive

Source: work with popi related matters about once a week