Holding officers of the company criminally & civilly liable seems like it would go further to solving the problem. If the CEO was worried about going to jail or being fined, he would have made sure the organization was a lot more focused on protecting individual data.