I like the approach of defining the cost of a breach, and letting the market figure out what is necessary to protect against it. If you prescribe something, all

I like the approach of defining the cost of a breach, and letting the market figure out what is necessary to protect against it. If you prescribe something, all you’re doing is creating a regulatory moat. And if a company decides that it can’t completely protect itself.. hey, what about not collecting so much bloody data?? Wouldn’t that be a lovely side effect? If (P.I.) data, by its very existence, became a toxic asset, to be handled only when absolutely necessary?