The problematic aspect of regulation is that you don't just need to comply, you need to _convince the regulators_ that you've complied. A better approach is to

The problematic aspect of regulation is that you don't just need to comply, you need to _convince the regulators_ that you've complied. A better approach is to create liability for certain specific failures if the company didn't follow reasonable best practices, which means you might get sued, but in that case it would be on the plaintiff to show that you didn't follow best practices, rather than the regulatory approach which makes it a burden on the company to prove to regulators (who have no incentive to keep costs of compliance down, or even limit themselves to cases where customers are in some sense harmed).