By litigate I mean, if a person is creating something and says they don't plan to distribute it, do we take their word for it?

If it ends up getting distributed anyway, should we take their word that it was an accident?

We consider people's private data important enough that if you leak it even by mistake you are on the hook for that. You have a responsibility.

I think that rather than framing this as something harmless unless distributed and therefore intent to distribute matters, we should treat it as something you have a responsibility not to create because it will be harmful when it is inevitably distributed.