Liability doesn't fix the damage that is already done. We can punish all the people involved in this, and it will still be the case that your drivers license is available for purchase and identity theft against anyone is now much easier. They don't have enough enough to repair the damage they've caused, even if we take everything from them.
The damage can't be undone, but you can learn from it and prevent these things from happening again and again. If every CEO truly believes that his personal wealth and freedom is at stake with the safety of his customers' personal data, they will see that ITsec becomes a cornerstone of the company instead of an annoying compliance sheet checkbox.
Liability can be a strong incentive to improve the system in the future.
No, but it changes the cost-benefit analysis for managers deciding to cut corners in future.
> Liability doesn't fix the damage that is already done.
Neither does imprisoning murderers for life, but it's one heck of a deterrent.