Again, if your belief is that the executive class can’t make meaningful change in this matter, (and I assume you accept that fines aren’t significantly felt by

Again, if your belief is that the executive class can’t make meaningful change in this matter, (and I assume you accept that fines aren’t significantly felt by the lower ranks), then fining itself is unreasonable: the company itself can’t really do anything about it. We can let people know the data has been lost... but thats it. The fining is just petty revenge, for succumbing to natural forces. The PR hit too: why disclose the company? But obviously you do believe its possible for the company to change its data security practices. Obviously you believe theres a scale to protective efforts. Who better to enforce such efforts than the bosses? If not them, then who? What position is better to effect change.. than being in charge? I agree that on any data loss, severe punishment is too much, simply because it’ll eventually happen for even mundane reasons; but discovering as a result of loss that they never did anything proper to protect that data is a pretty damned good reason for larger punishment. I can agree that executives today have little to know insight on their data management practices, but I don’t at all see why they can’t have it tomorrow (or more likely, offloading that insight onto third party auditors, as you’d do for finances, gdpr compliance, and really anything you’re too busy to be personally involved in)