Wouldn't the register be metadata about the breach? Why would it include the actual breached data? This would be essentially "Have I been Pwned" with some legislative teeth and funding - perhaps from the penalities imposed on the offenders!