To me it seems obvious that I personally should be entitled to monetary compensation if my data has been breached or was not protected as regulation requires.