I'm fine for a judge and jury to decide what is and isn't actually criminal conduct and whether the EO was negligent in protecting customer data. It needs to be

I'm fine for a judge and jury to decide what is and isn't actually criminal conduct and whether the EO was negligent in protecting customer data. It needs to be explicitly illegal first, though.