Has the FTC ever suggested holding anyone personally accountable for privacy failures before? I've never heard of this even being suggested before.