Well, there is that. Maybe reality is that no set of security practices can ever secure PII. If so, that's an even bigger problem than lackadaisical firms like Equifax.

But I think higher expectations, helped along with civil legal machinery that's likely to mete out meaningful punishment, would move us faster to finding out whether the problems are mostly just sloppy practice (which responds to economic penalties) or whether they're more fundamental and need a different fix.