Large fines can—and probably should—be relative. Edit: I’m not sure I’ve ever heard anyone suggest “regulatory capture” as a reason to not levy fines against c

Large fines can—and probably should—be relative. Edit: I’m not sure I’ve ever heard anyone suggest “regulatory capture” as a reason to not levy fines against companies who held breached data. HN discussions on this topic seem to trade in the same repeated points—“identity theft” is bank failure/fraud masquerading as the customer’s problem; there should be consequences and/or fines for the party who held the data; the frequency of breaches should make us rethink how private PII really is; etc.