Governments and companies today collect excessive amounts of data about people: state registers, KYC databases, e-invoices, eKasa (Slovakia’s mandatory online cash-register system). Sooner or later, one of these databases leaks. That’s exactly what happened in Poland at the end of September 2026. Attackers broke into the servers of Fakturownia, a popular invoicing service that companies also use to submit invoices to KSeF, Poland’s state system for mandatory e-invoicing. According to the company’s own statement, the incident affects every single account, and the leaked data may include the names, tax IDs and addresses of companies and their customers, invoice amounts, payments with account numbers, and API keys.

When a database leaks, the risk falls on the people whose data ends up on the darknet. The authorities send them a notification letter, the company sends an apologetic email, and almost nobody gets compensated.

I personally know someone whose KYC data leaked. Fraudsters used his details to sign up on crypto exchanges and committed fraud in his name, again and again, in various countries. Even though he applied for new documents, he’s completely desperate, because his name is already blacklisted by a huge number of services. None of this would have happened if he hadn’t been forced through a KYC process that wasn’t even necessary for what he needed to do.

France: from data leaks to kidnappings

According to a Chainalysis analysis from August 2026, France had only a handful of known violent attacks on crypto holders before 2025. In 2025 there were 19, and in the first half of 2026 alone there were already 30. At the end of June 2026, French Interior Minister Laurent Nuñez spoke of more than 70 documented cases. In more than 40% of the French cases, the attackers didn’t go after the crypto holders themselves but after their relatives.

Chainalysis points to a data leak as the most likely cause. In 2024, an employee of the tax administration in the Paris region allegedly stole files on wealthy crypto holders and sold them to criminals: names, addresses, phone numbers, assets and tax records.

In this context, the media describe the case of a former tax office employee in Bobigny who, according to investigators, searched the tax system for crypto investors as well as for the address of a prison guard who was brutally attacked at home in September 2024. She admitted to passing the information on; investigators found cash deposits and Western Union transfers.

On top of that, in summer 2026, attackers using stolen login credentials pulled data on 678,000 people and companies out of the French tax administration DGFiP. The state collects the data and can’t protect it.

The hardcore solution: jail for every leak

Introduce criminal liability for any data leak whatsoever.

A government official would actually go to jail if someone hacked a state database of citizens they’re responsible for. The same would apply to whoever runs a KYC database, an e-invoicing platform or any of the other systems that nobody needed just a few years ago and that today serve only to spy on the entire population.

The effect would be:

1. The security of every system that collects any personal data would improve dramatically (because jail would be on the line).
2. Since security is expensive and nobody wants to go to jail, there would be strong pressure to remove every surveillance mechanism that isn’t essential for the service to work.

Most services can work without KYC. Exchanges, online shops and mobile operators can technically run in anonymous or pseudonymous mode. The fact that MiCA and AML rules currently forbid this for exchanges in the EU is simply a consequence of nobody having to pay for leaking personal data, which makes mass collection cheap. After all, anonymous mode is exactly in the spirit of the GDPR’s data minimisation principle: under Article 5(1)(c), personal data must be “adequate, relevant and limited to what is necessary in relation to the purposes for which they are processed”.

The result would be far better privacy for every citizen. There would be fewer crypto kidnappings and less trading in harvested data, and far fewer leaked databases would be up for sale on darknet markets.

If someone wants KYC and mass surveillance, fine, let them introduce it. But at the same time, let them name the specific people who will be criminally liable and end up in jail when someone hacks and abuses that database.

Except this will never happen, because the state wants to spy on you no matter what, even at the cost of putting your privacy at maximum risk. The French victims of the crypto kidnappings described above could tell you all about it. And the state, of course, doesn’t want to and never will take responsibility for anything.

The fairer solution: a price tag on every record

Jailing someone just for getting hacked wouldn’t be fair, though. There’s no such thing as an unhackable system, and nobody should go to prison over a 0-day vulnerability that someone else used against them. A fairer and at the same time more effective version looks like this:

• Fixed compensation for every leaked record, paid directly to the people affected. Automatically, with no courts and no need to prove damage. For example, €500 per record containing sensitive data such as a birth number (the Slovak personal ID number), an ID document number or a signature, so a leak of a database of a million people would cost 500 million euros.
• Criminal liability only for gross negligence and for covering up a leak. By gross negligence I mean, for example, a system left unpatched for years, passwords stored in readable form (plaintext), or collecting data the service doesn’t need at all.
• If the state mandates the collection, the state pays the compensation. Yes, we’ll all pay for it through our taxes. But that will make it all the more visible how much mass surveillance actually costs us. Every new register, such as e-invoicing or mandatory KYC, would come with a clear price tag in the budget.

The effect: insurers would start pricing every stored record. The cheapest security would be not collecting the data at all. How much data is worth keeping would be decided not by a bureaucrat, but by the market.

If you want to collect any information, that’s fine, but you have to get insured and it will cost you dearly. So you’ll have a clear economic incentive to make sure your service can be built and delivered without collecting personal data.

And the people whose data leaked would finally get compensated. Not just an email along the lines of “Your data may have been compromised, we recommend changing your password”.

Economists call this a negative externality. Today, a data leak is like a polluted river: the operator pockets the profit from collecting the data, while others bear the damage. Fixed compensation is just the old “polluter pays” principle applied to data. Bruce Schneier summed it up back in 2016 in his essay Data Is a Toxic Asset: data is a toxic asset, and storing it is dangerous.

Why €500?

It’s an indicative figure for sensitive data. The rate should rise with how much harm a leak can do to a person:

• email address or phone number: a few euros,
• name with address: tens of euros,
• birth number, ID document number, signature, health or wealth data: hundreds of euros,
• address combined with wealth data, i.e. exactly what served the kidnappers in France as a target list: even more.

That’s exactly how an insurer would think. And a company would very quickly discover that it doesn’t need a customer’s birth number to deliver its service.

An example from Slovakia

Since 17 August 2026, the Slovak Business Register has, by law, been publicly disclosing the birth numbers, permanent residence addresses, ID card numbers and specimen signatures of the managing directors and shareholders of roughly half a million companies. That’s hundreds of thousands of people. Publication is worse than a leak, because it’s permanent and open to everyone, so it should be counted the same way. At €500 per record, the state would pay hundreds of millions of euros for this one legislative decision. I suspect that with a price tag like that, parliament would think twice.

Today it works the other way round

Under Article 82, the GDPR does give anyone who has suffered damage from an infringement the right to compensation, but they have to sue for it and prove the damage. An infringement of the GDPR alone isn’t enough for compensation, as the Court of Justice of the EU confirmed in 2023 in its judgment C-300/21 (Österreichische Post). And fines imposed by supervisory authorities go into the state budget, not to the people whose data leaked.

What the GDPR says: best not to collect at all

None of this is exotic. The GDPR already recommends exactly this today; the victims just get nothing out of it:

• Don’t collect at all. Under Article 25(2) of the GDPR, controllers must ensure that, by default, “only personal data which are necessary for each specific purpose of the processing are processed”. This applies to the amount of data collected, the extent of processing, the storage period and who has access to it.
• Anonymise. Under Recital 26, the GDPR doesn’t apply to anonymous data at all, and truly anonymous data puts no one at risk, even when it leaks. Genuine anonymisation is harder than it looks, though. Back in 2000, Latanya Sweeney showed that ZIP code, date of birth and gender are enough to uniquely identify 87% of the US population. Removing names from a database isn’t enough.
• Pseudonymise. If personal data really can’t be avoided, Article 25(1) and Article 32(1)(a) list pseudonymisation and encryption as basic safeguards. The European Data Protection Board explains how to do this in practice in its Guidelines 01/2025 on Pseudonymisation and its Guidelines 4/2019 on Article 25 Data Protection by Design and by Default.

Fixed compensation for every leaked record would turn these recommendations into hard economic reality.

Objections

“KYC is essential in the fight against money laundering.” The evidence that it works is very weak. According to Ronald Pol’s analysis (2020), anti-money laundering rules affect less than 0.1% of criminal proceeds. The price is paid by every customer whose data gets collected, and, when it leaks, with their privacy as well.

“It would put companies out of business.” The ones that collect far more than they need, yes. That’s exactly the point. A company that holds only the data it actually needs will pay little for insurance.

“How do you tell which database a leak came from?” Leaked databases can usually be attributed by their structure and content. On top of that, an honest operator can plant control entries (canary records) in their database: if those don’t show up in the leaked data, they can easily prove the leak didn’t come from them. That’s another reason why covering up a leak should be a criminal offence.

What it would mean for us as a company

As a business owner, I can easily imagine the fixed-compensation model applying to us too, with respect to the customers we collect information about. And I think it’s fair.

As a company, though, we can’t get away with collecting nothing at all about our clients. Under Section 74 of the Slovak VAT Act, an invoice must contain the customer’s name, address and VAT ID, and under Section 76 we have to keep it for 10 years.

Although we’d love to offer our services anonymously and for anonymous cryptocurrencies, unfortunately that’s not possible. You can also pay us in stablecoins with a 4% discount (in Slovak), but we still have to issue an invoice with your name and address. The state forces us to collect our customers’ personal information and then to protect it as well.

Mobile operators are in a similar position. In the Czech Republic, you can still buy a prepaid SIM without any identification. A Slovak operator, under Section 86(2)(b) of the Slovak Electronic Communications Act, must obtain and record data even about prepaid SIM customers, to the extent set out in Section 110(2)(a): name, permanent residence address, birth number, ID card number and nationality.

I believe pressure to compensate victims would shift this legislation too. Leak insurance would cost a Slovak operator, which has to keep records of its prepaid SIM customers’ birth numbers, more than a Czech one, which doesn’t.

We wrote about how to at least partly get around mandatory SIM registration in the article How to maximize anonymity when accessing the Internet on mobile.

Economic incentives would ensure that society collects only the information that is genuinely necessary to deliver or perform a service. Not the excessive collection driven by the state and its officials wanting maximum control over the population: KYC, eKasa (in Slovak), e-invoicing and so on.

The bottom line

Data you don’t collect can’t leak, can’t be sold, and won’t bring anyone knocking on your family’s door.

As long as an operator doesn’t have to compensate the victims, a database leak will be cheaper for them than securing it, and both the state and companies will keep collecting everything.

Just put a price on every record and the market will take care of the rest.