Every single report like this serves to make me feel sick and angry. These organizations are responsible for so much data that can literally ruin lives and they can't be bothered to think through their solutions. It's not but should be criminal.
Yes, but the penalties have to be such that the exec does not simply view it as "cost of doing business" and mark it down as a business expense.
I guess we're arguing for non-financial penalties...