Neither approach is perfect. Personally I prefer the spirit approach as companies will generally do more harm than regulators given some rope.