whilst data leaks are not punished---
----then of course action is only taken too late to matter.
Until there is adequate punishment for data mismanagement then handing your real data is an expense to everyone in your country.
At the minimum the directors of any company having a data leak should be held responsible for any losses the effected customer suffer, with the onus on the company to prove that the lose was not their fault.
I would say that the directors of a company leaking data at this point are negligent, there are plenty of companies that are available to lock data down and there has been plenty of press attention for the historical data leaks.
When laws change people are still held responsible even if they were unaware of the changes because were published on TV and in newspaper, if people why not companies?
Biting the hand that feeds IT
