Despite decades of hacking attacks, companies leave sensitive data unprotected

The fact that credit agencies, etc are allowed to report incorrect information without consequence is a similar problem. There's no incentive for them to ensure accurate info. In fact they're incentivized to accept false information as it lets them offer "credit monitoring" as a service people have to pay for.

If we take a scenario where sensitive data is taken but there is no impact on business operations (e.g. encrypted systems & backups) it is difficult for businesses to be impacted apart from reputational damage. And realistically given the amount of cyber attacks on the news, chances are your customers will forget about it over a short period of time.

The issue with reputational damage is that we are in this "new" world of cyber security and we know its important and everyone else is being attacked (it seems). But also many people if not most people don't have security together themselves, or have any idea of how to poke a stick at it. So we're in this not so mature stage of cyber security where if a organisation has its data taken, it's more forgiving than say rampant financial fraud. Which has had decades if not centuries of global fraud incidents impacting the pockets of billions of people. As such when it comes to financial risk and penalties, there are more real scenarios in which people can do the wrong thing and it have a material impact.

It's simply a case of there not having been enough material cyber security incidents that have generally impacted people and organisations. It's got to get worse before it gets better.

I agree with you that the cap is too low. It should cap based on gross or revenue. I suspect it's so that the smaller companies won't get destroyed by fines leaving the larger ones largely unaffected, but I'm speculating.