That should be the case, but the frequent data breaches that I get notified about with little consequence to the companies involved make me doubt that there will be real incentives for good behavior.