I think you need a few prongs, but not keen on CEO jail time. CEOs likely don't have enough visibility into day-to-day to have an impact on data security. The

I think you need a few prongs, but not keen on CEO jail time. CEOs likely don't have enough visibility into day-to-day to have an impact on data security. They set the tone, but they won't have time to personally validate the work is being done to proper security standards. Few ideas, to be used in conjunction: 1) Fine the shit out of violating companies. Base fines with the same aggressive tactics they use to compute fines for piracy -- leak 1M records, pay $100 x 1M in files. And have to set up identity protection for your consumers -- all that good stuff. 2) Reward good behaviour. Set a third-party standards, if a company submits to that, and passes, give them 1 strike per year where they don't have to pay the files. Worried about how to set these? Don't me, EY or Accenture or Deloitte will set fairly comprehensive standards, as long as they are allowed to charge for the audits. 3) Protect whistle blowers and offer rewards. If you go through proper channels, you won't be fired. And if your company fails to act, and then you narc on them, you should get a bonus. A massive fucking bonus. You see shady, you report shady, you get a hero's bounty.