[mannschott]

I'm not seeing "significant liability" in how even major data breaches have been handled in the US so far. Where are the fines large enough to be noticed for gross negligence? Where are the prisons terms for the captains of industry that set the priorities and determine the budgets that inevitably lead to such negligence?

Equifax? Yahoo? Target? Heartland? TJX? eBay? JP Morgan Chase? Adult Friend Finder? Locationsmart and the cell phone carriers providing real time location information on all of their customers to third parties?

A CEO of a major corporation The Land of the Free™, wouldn't consider liability for negligent data handling very seriously given the government's seeming lack of interest in seriously prosecuting same. S/he'd probably even argue that investing more in security would lower profits and harm investors. And we can't have that.

What am I missing?