This flows from the top down. The consequences to companies that leak private data are so minor why would someone lose their job for risking a leak? At worst it

This flows from the top down. The consequences to companies that leak private data are so minor why would someone lose their job for risking a leak? At worst it's a fine that amounts to a slap on the wrist. Things that limit civil liability like mandatory arbitration clauses have made this worse.