Hacker News Reader

what? ofcourse you can.

just look at any industry that puts people in danger when people make technically incompetent mistakes.

even the most basic electrician is held to a higher standard then facebook in this regard...

Surely you can - that could amount to criminal negligence which is definitely a crime.

Yes, you can and should. But how do you define negligence in IT? We don't have the same codified norms as civil engineering so it'd be very subjective.

I feel the best test was "did you get breached? what data was taken?", if the answers are yes and PII, you were collecting data that you didn't have the capability to protect and should face a fine.

There is a lot a company can do to protect data. If they demonstrate that they were following all those best practices re: encryption, storage, least privilege, etc. then that should absolutely factor in.

At least to hold people accountable who store stuff in plain text and leave it on publicly accessible storage.

That is not an excuse. Imagine not fining people for reckless driving.