I think the problem with this thinking is that even without explicit fines, the costs of a data breach are already incredibly high for companies. There's the po

I think the problem with this thinking is that even without explicit fines, the costs of a data breach are already incredibly high for companies. There's the potential loss of sales for a customer-facing business, as well as costs of class action lawsuits, system cleanup, etc. Sony Pictures was crippled by a cyberattack. Target's CEO was forced to resign. So, maybe fines would make this situation better, but CEO's should already be up at night worrying about cybersecurity. My inclination would be to pursue better security, but also to go after the really sophisticated cybercriminals that are currently outside the reach of our legal system.