>Here's how it could work. It's similar to how copyrights for music are enforced. A person whose data are found in someone's files or server can sue for "statutory" damages, which are levied on a per-offense basis.

That's not how copyright lawsuits work though. For the typical person torrenting, it's because they were caught in the act of torrenting (eg. they had a torrent client in the swarm connecting from an ip that was assigned to them). Otherwise it's a DMCA takedown and companies don't even bother suing. Nobody is getting their hard drives searched for illegal music and getting sued as a result.

That's right. I'm not talking about copyright, but about a new restriction on possession of the data. The only parallel is the use of statutory damages as a remedy.

What are the odds individuals learn their data has been found. What kind of damages could be awarded that would make hiring a lawyer and giving them 50% of winnings a worth while effort? I could also easily see individual cases combining to become class action reducing the winnings even further.

In other words, I find this a silly suggestion as it's just never going to work in the real world.

I seem to find out my data has been leaked in a breach every other month. I don't even care if I actually get the money for it, let it go to the class action lawyers. Life is good so long as the companies pay more than they make by holding the data.