Mandatory data breach notices have triggered lawsuits. Lawsuits have led to class action lawsuits. Think Target and Home Depot, the big retail data breaches. Class Action lawsuits lead to settlements.
Whether one agrees or not what the impact of tort reform will be, data security is ripe for tort reform.