There are rules in the United States too, but a lot of places get it wrong. There is HIPPA, FERPA, PII, etc. More often than not a company thinks they're compl

There are rules in the United States too, but a lot of places get it wrong. There is HIPPA, FERPA, PII, etc. More often than not a company thinks they're compliant but then after a break-in is found to be lacking something big like hashing passwords.