[jampekka]

If security is non-negotiable, the only solution is to destroy the data so that it can't be ever recovered by anybody. Or even better not having any data in the first place.

Securing some data is very important. Some data indeed shouldn't exist in the first place. But for a lot of data it matters very little. Most security breaches have rather mild consequences.

Treating all data as megatopsecret and all security breaches as end of the company produces not only unproductive systems, but bad security.

[jimbokun]

Well, I work for a company that processes Private Health Information, so a breach is a potential existential threat.

[jampekka]

Breach to private health information that can be linked to an individual more exactly? Is this kind of information all around the organization's computers?