> Personal liability for every person involved in gathering and protecting the data I think it should only be the business that incurs the penalty. That way i

> Personal liability for every person involved in gathering and protecting the data I think it should only be the business that incurs the penalty. That way it is the business that is motivated to sufficiently train and oversee the employees. Otherwise, you have employees on the hook, with employers incentivized to make them take shortcuts.