Putting someone in jail for maybe 2-5 years while there families can get on with there lives I don't believe has been shown to have any real effect on the companies that have OUR DATA.
Until there are real consequences to the upper management of these companies (as part of that group of people I mean those that allocated what to spend to protect OUR DATA) such as large monetary penalties that are not covered by company or personal insurance so the people responsible, and their families, can feel the consequences of not doing everything that is necessary to protect the customers sensitive data. as part of that group of people I mean those that allocated what to spend to protect OUR DATA