The speaker argues for regulatory penalties rather than class-action for data breaches, citing concerns with attributing damages. They also mention the difficulties with connecting password breaches to identity theft.