> I'm open to that, but what is the plan for forcing organizations that are doing the wrong thing to do the right thing? i'd say figure out how bad what they d

> I'm open to that, but what is the plan for forcing organizations that are doing the wrong thing to do the right thing? i'd say figure out how bad what they did is. Not hashing and building sql strings like that: go to jail for a long time. Gross carelessness with private data: go to jail for a very long time. About the same time as if you purposely published the data, or purposely dropped a table, because thats about what you did. If you dont have the competence, you have no business writing such a system. If you dont know how to calculate a bridge that wont collapse, or dont know how to follow the plans and build it properly, you have no business being there.