Except that there is precedence for these types of standards and laws in other industries: PCI [0] is an industry standard which is mandated in order to mainta

Except that there is precedence for these types of standards and laws in other industries: PCI [0] is an industry standard which is mandated in order to maintain good standing in the payments industry and HIPAA [1] is US legislation which governs the handling of patient health data. The issue we face is that there is no equivalent for either of these in relation to handling of PII and identity data. [0] https://www.pcisecuritystandards.org/ https://www.pcisecuritystandards.org/ [1] https://www.hhs.gov/hipaa/index.html https://www.hhs.gov/hipaa/index.html