What does it mean for the industry to self-regulate? How do you define industry? Is it telecoms, or all tech companies?

Self-regulation has failed because the cost of a data breach remains relatively low compared to implementing security measures, at least on the surface.