What we need is personal accountability, not the firm being fined, but the individuals who are responsible for setting and carrying out data policy. As it stands, the customer or tax payer picks up the tab for any fines, so there is no incentive to take responsibility.