Where's the conundrum?
"Should breaches be reported?"
Yes. Maybe not to the general public, but certainly to the relevant authorities, same as when bank's vaults are breached.
"When should breaches be reported?"
"What constitute a breach?"
The Australian Government has a list of items it considers vital for identifying a person (or vice-versa, for a person to identify themselves to an authority). These include, but are not limited to; name, date of birth, gender, residential address, passport number, driver's licence number, credit card details, etc...
Any breach in which two or more of these pieces of data could have been revealed need to be reported.
End of story. If companies are suddenly saddled with the care-and-upkeep of the data they collect under pain of a Federal indictment maybe they would then (a) take more care with the data they collect and (b) review whether or not they actually need to collect that data compared to the legal hassle of having to protect it.