We need personal data protection laws in this country so that as an individual after a data breach at wherever I can personally sue them for damages. Potentially very significant damages if they leak a full dossier like a credit reporting agency.
If that happens the whole calculus of bug bounties changes immediately.
If that happens the whole calculus of bug bounties changes immediately.