The Talktalk data leak actually seems like criminal negligence. I don't know the British law, but that level of negligence at least should be criminal.