Doesn't PCI work well in general? It has a large amount of overhead but we see very few credit card breaches from within the "PCI vault," while we see many Soci

Doesn't PCI work well in general? It has a large amount of overhead but we see very few credit card breaches from within the "PCI vault," while we see many Social Security number breaches and email/password combinations. For example, the Target credit card breach occurred because malware intercepted the credit card information at the Point of Sale appliances before the information was encrypted and transmitted. Prison time seems extreme, but Congress should should absolutely establish statutory fines (for companies) for breaches of PII. Then any company officer can save the company money by simply spending more on prevention because it will lower breach insurance premiums.