It's quite clear at this stage having technological solutions to password authentication simply isn't enough. We need to make it a criminally prosecutable offen

It's quite clear at this stage having technological solutions to password authentication simply isn't enough. We need to make it a criminally prosecutable offence for services of a certain size not to use them. The company that produced that 105 million record database, regardless of whether this turns out to be infiltration by an outsider or an inside job, should be sued for gross negligence. Why can't we do this when the EU can pass useless cookie directives?