I'm not against all regulations - some can be useful - they just need to be implemented with great caution - ideally in a way that is very easy and clear to implement. In theory I don't see how regulations could avoid security breaches anyway (which I think is a greater problem). It'd be interesting to fine large companies with security breaches to encourage better tech, but then they'd never report it.