As a consumer I'm sick of seeing these data breaches. The market is not solving this problem. We need legislation to force businesses to do security audits of

As a consumer I'm sick of seeing these data breaches. The market is not solving this problem. We need legislation to force businesses to do security audits of their products if they collect PII, and fix the bugs in a reasonable time frame. If they don't they need major penalties that are recurring and increase over time. This way a whistleblower can report their company if they fail to properly perform an audit or fail to fix the bugs. This may seem toothless, but avoiding shame and fines is a big motivator for companies in industries where data privacy regulation exists. If we can force them to start investing in security, that reduces the likelihood of security holes sticking around forever, leading to breach.