Some people argue that the current system for addressing consumer concerns related to personal data breaches puts too much burden on consumers and not enough responsibility on corporations and other entities whose systems' vulnerabilities enabled the breach in the first place. Why might someone make this argument?