I'm Testifying to Congress about Data Breaches – What Should I Say?
To me, the main issue is accountability.<p>A citizen's data can be collected, badly secured, stolen, and used by criminals without the user ever being aware of step 1. Just like a citizen can get ill from swimming in a river without ever being aware of the factories upstream.<p>The solution is not to force citizens to constantly be on the lookout. It's to severely punish polluters and leakers.<p>When a CTO says "let's collect geolocations", the CEO should  should have legal and business reasons to say "no way, it's not worth the financial risk of losing them; it could destroy our company."<p>---<p>Update: I do <i>not</i> think the government should mandate specific practices; it's too complicated, too fast-changing, and too hard to police.<p>It should be entirely results-based. You lose people's data, you pay big bucks. Figuring out how not to lose it is <i>your</i> problem. The government sets the rules, and the market plays the game.