A scenario is pretty simple: They don’t hire enough security personnel to safeguard your data. They get hacked. There is very little damages you could get in arbitration for losing that data, so nothing happens. You cannot form a class to actually make something happen.