<i>Your data being accessible as part of a breach does not entitle you to damages if nothing actually happens to you.</i><p>The trouble with relying on a compensation principle alone is that invasion of privacy is typically one of the harms you cannot entirely make good retrospectively. A lot of personal data is like Pandora&#x27;s box: once released, it is out there forever and the data subject is forever at risk of adverse consequences.<p>Not all of those adverse consequences can be quantified in purely economic terms. Financial awards are merely the most pragmatic mechanism we have been able to establish so far to give some form of compensation after the fact. If you&#x27;ve ever been the victim of identity theft, or of a physical crime like burglary, you&#x27;ll probably understand the sense of violation I am talking about. You&#x27;ll probably also know that it doesn&#x27;t go away just because you have a monitoring service on your financials or you changed the locks on your home.<p>Financial compensation for actual damages can&#x27;t remove the feeling of being vulnerable that haunts you after you&#x27;ve been the victim of such an incident, and so there is also a need for processes and deterrents to reduce the risk of the incident happening in the first place.