"We used best practices to protect your data" is such a bullshit excuse. If a bank gets robbed its customers aren't told "sorry your money is gone, but we had it behind a locked door, so we're not liable".

If a company decides to collect, store and profit off of my personal data and they lose it, I really don't care about "best practices". They profited from my data, they have to pay if they lose it. The company always has the choice of not storing the data in the first place, if they can't bear the risk of a substantial fine in case my data is disclosed.