Australia has legislation & regulation - If you're operating here, failure to notify the regulator and stakeholders about certain types of data breaches within 30 days opens you to fines and civil penalties.
At the least OAI should cop similar penalties, before getting into damages.
At the least OAI should cop similar penalties, before getting into damages.