I'm not sure it means jail time. It does need to be substantive. Holding the CEO, CTO and CSO directly accountable is a start. But I think it needs to be compan

I'm not sure it means jail time. It does need to be substantive. Holding the CEO, CTO and CSO directly accountable is a start. But I think it needs to be company wide. It needs to be punitive damage to the company and its shareholders. The risk of mishandling PII and similar data needs to outway the benefit (that may differ per type of PII). At that point it would be my theory that consolidation around best practices, software, security audits... would become the norm. It would raise the cost of a company taking on the responsibility itself, that they'd rely on others to reduce the cost through volume. It would probably start looking a lot like PCI and credit card co. Requirements. The big difference here being that there isn't an industry body responsible, but the government, which would always be political and probably not have enough teeth.