They technically are, but at least in the US we're allergic to "anti-business" punitive fines and liability, so it ends up as a cost of doing business. Wouldn't want an anti-business law to scare away a company leaking everybody's data. Think of the economy!