[maxerickson]

Are you being pedantic about forcing them or are you unaware that most U.S. states have notification laws that apply when a data breach involves personal information?