A bank not locking their vaults would probably be slapped with a few dozen criminal charges in court. Why would that not apply for electronics? If you've committed to protecting the data, you're supposed to make a reasonable effort to actually do so.