Agreed. Statutory, automatic penalties for data mishandling or negligence need to be brought in.

Right now, there are few penalties, outside of a brief reputational hit, for large firms that lose control of customer data.