It’s something that is present throughout the economy and that the law fails to adequately address. Try negotiating a data protection agreement with a major player and then tell me that the controller/processor dichotomy adequately allocates risks.