Let me re-state what your saying: Most sites are incapable of receiving, storing and handling credit card numbers. This is because the staff building the servi

Let me re-state what your saying: Most sites are incapable of receiving, storing and handling credit card numbers. This is because the staff building the service either lacks the technical knowhow or the organizational wherewithal to deal with the problem in a successful way. Why should it be any different for emails, names, usernames or passwords (because end users re-use those). If everyone starts acting like this data is important (it is) and valuable (it is and that might decrease with the passage of this law) - we might just get to a better place. In the absence of regulation companies will get away with whatever they can - ethics be dammed.