>They're drawing a significant amount of money from the system and transferring it to their governments' general accounts. Is that the best use of that money? S

>They're drawing a significant amount of money from the system and transferring it to their governments' general accounts. Is that the best use of that money? Should some of that money be used to help address infosec problems? Well the point of these fines is to say to organisations "put your money into infosec, or when you have a breach it'll probably be your fault and we'll take that money as a punishment". >Should some of that money be used to help address infosec problems? To fund training for citizens, legislators, and governments? To step up law enforcement efforts against cybercreeps? To publicly fund independent security researchers (white-hat hackers) to help detect this stuff and nip it in the bud? To help subsidize the significant expense of comprehensive infosec audits for municipal governments, ngos, and small firms? The NCSC[0], GCHQ's defensive side, publishes advice for the public, companies, charities, schools, government departments etc. [0] https://www.ncsc.gov.uk/ https://www.ncsc.gov.uk/