This may be fixed in the very near future. CCPA -- the California Consumer Privacy Act -- has real penalties for data breaches [0]. When there is pure neglige

This may be fixed in the very near future. CCPA -- the California Consumer Privacy Act -- has real penalties for data breaches [0]. When there is pure negligence in play and the business doesn't cure with 30 days notice, the law seems to explicitly provide for a minimum $100 / person penalty. And up to $750. There are amendments in play to remove the 30 day cure grace period; whether they pass this year or not, we'll have them within 5 years (personal bet). Basically, breaches can be an extinction event for a company in California starting 1 January 2020. A couple companies are gonna take one for the team, and shortly thereafter, boards will be very interested in security postures. [0] https://iapp.org/resources/article/california-consumer-privacy-act-of-2018/#1798.185 https://iapp.org/resources/article/california-consumer-priva...