> ...it's practically the universal response from people who don't know what they're doing. It would be a start to simply mandate that businesses collecting an

> ...it's practically the universal response from people who don't know what they're doing. It would be a start to simply mandate that businesses collecting any personal information from users publish a policy on how users can report breaches. Fine them much more severely if they have a real breach but did not publish such a policy, or if they ignored a previous report of that breach submitted to them under that policy.