Read Usama Kahf’s article about automatic civil liability for a data breach on Lexology :
No! It is a common misconception among the general public that someone always has to pay when there is a data breach. It is understandable that individuals affected by a data breach will be upset, distraught, and even angry.
Read his full article here.