The Director of Security at a bank should at least be fired if their bank is robbed by a guy brandishing a banana. I'd speculate that that's the nature of most data breaches: amateur attackers taking advantage of grossly incompetent security.

Well I think bank tellers where I live are instructed to comply with robber's demands for money even if they are not visibly brandishing any weapon

No one said anything about holding the CTO personally liable. The idea is to hold the company liable. This makes sense because the company is in the best position to prevent the bad outcome. If the company is always liable, it can find an optimal balance between the costs of security and the costs of breaches.

If the company is only liable when negligent, it is incentivized to minimize the cost of security to the bare non-negligent minimum. This pushes all the costs onto the people whose data are compromised. These people are not in a position to spend small amounts of money to dramatically lower the expected costs of breaches, so they just end up paying huge costs that cannot be mitigated.

> While I agree, as a CTO I would be terrified if a data breach could hold me personally liable.

Personal liability is going too far, IMO.

> Mistakes should not be punished as long as there is not also negligence.

The problem with this is that you'd have to enshrine, in law, what "negligence" is. Technology changes too fast to put that into law.

"How many people got hurt and how badly?" is a question attorneys can reasonably address. "Was there sufficient input sanitization?" is not.