> The only thing an executive can really do is issue a directive along the lines of 'we will do things this way', and then leave the interpretation of that dire

> The only thing an executive can really do is issue a directive along the lines of 'we will do things this way', and then leave the interpretation of that directive to the lower ranks. That is not really true. 1) Executives can allocate sufficient resources to data protection. 2) Executives can set up a data protection committee that has similar powers to the audit committee. In the UK this would normally be placed under the non-exec chairman's control. 3) Executives can insist on an external audit Corporate governance is complicated, but not impossible. Executives manage to keep control off the shareholders money, despite never touching it themselves. They can learn to do the same with data.