I am not a lawyer, my question was rhetoric. As a layman I would argue that we know anyway that these kinds of laws are rarely ever enforced upon companies the

I am not a lawyer, my question was rhetoric. As a layman I would argue that we know anyway that these kinds of laws are rarely ever enforced upon companies the size of Sony. Especially not when there's a political PR spin as convenient as "omg North Korea" (was: "omg terrorists"). However, the least that they have obviously violated (on multiple occasions) are the PCI-DSS diligence requirements and probably every data protection act under the sun.