> as long as you didn't do anything too careless Who determines how much careless is "too" careless? "slightly careless" but with huge consequences is more con

> as long as you didn't do anything too careless Who determines how much careless is "too" careless? "slightly careless" but with huge consequences is more concerning than "incredibly careless" but with no consequences. Really the punishment should be matching the value of the breach. For example with HIPAA breaches, you can get fined $10k or so, PER RECORD -- obviously medical data is exceptionally more sensitive than most. Credit data should be covered under a HIPAA-like statute. Under HIPAA there's no such thing as "a little careless" -- you either f'ed up or you didn't. There's no gray area.