> While I agree, as a CTO I would be terrified if a data breach could hold me personally liable. Personal liability is going too far, IMO. > Mistakes should n

> While I agree, as a CTO I would be terrified if a data breach could hold me personally liable. Personal liability is going too far, IMO. > Mistakes should not be punished as long as there is not also negligence. The problem with this is that you'd have to enshrine, in law, what "negligence" is. Technology changes too fast to put that into law. "How many people got hurt and how badly?" is a question attorneys can reasonably address. "Was there sufficient input sanitization?" is not.