I like as well to remind people that law is there too. Law is like the ultimate border of information systems. Sometimes it's too hard or cumbersome to implement a security procedure to prevent a behavior, but the law is there anyway. It's kind of reparation versus prevention, but it's there anyways, and it's enough for many use cases.