Tell the truth or someone will tell it for you.
Should entities be able to write, "Your data may have been accessed" when they know it was not only accessed but was acquired?"
Should entities have to notify people that their data has been dumped on the dark web?