It also has to do with what kind of data is allowed in transit and at rest as per the examples I gave which are all around legal and commercial regulatory compliance. It has never been a free-for-all where operators use their personal judgement. In several territories you need to be registered with the government to collect certain kinds of data for a start.
But now we are at the point where there is sufficient data being collected and aggregated (by both public and private orgs) that hacks can damage economic infrastructure and harm wider society i.e. not limited to those who have interacted with a particular entity. This means that light touch regulation is completely untenable (quite apart from the general naivety of looking to the market to solve problems it could not even theoretically be solved in the marketplace when your infrastructure itself is toast).
But now we are at the point where there is sufficient data being collected and aggregated (by both public and private orgs) that hacks can damage economic infrastructure and harm wider society i.e. not limited to those who have interacted with a particular entity. This means that light touch regulation is completely untenable (quite apart from the general naivety of looking to the market to solve problems it could not even theoretically be solved in the marketplace when your infrastructure itself is toast).