It’s not crazy to have specific procedures, but think about unintended consequences. The procedures need to be achievable in the real world, not so burdensome t

It’s not crazy to have specific procedures, but think about unintended consequences. The procedures need to be achievable in the real world, not so burdensome they can’t or won’t be followed. Maybe a better example, let’s say NZ institutes a $50,000 fine per each occurrence of misuse of personal information collected per their requirements. Now a small business owner could find out they are facing a $250,000 fine and bankruptcy because of one horny employee violating their specific trading instructions. What restaurant would ever take that risk? If the government wants to force businesses to collect personal information, it better be prepared to provide secure means of collecting and communicating that information to them. And it should indemnify the businesses for any liability from release of that information that’s not willful or intentional. If the business faithfully follows the rules, punish the perpetrator, not the business owner.