I'm Testifying to Congress about Data Breaches – What Should I Say?
To me, the main issue is accountability.A citizen's data can be collected, badly secured, stolen, and used by criminals without the user ever being aware of step 1. Just like a citizen can get ill from swimming in a river without ever being aware of the factories upstream.The solution is not to force citizens to constantly be on the lookout. It's to severely punish polluters and leakers.When a CTO says "let's collect geolocations", the CEO should  should have legal and business reasons to say "no way, it's not worth the financial risk of losing them; it could destroy our company."---Update: I do not think the government should mandate specific practices; it's too complicated, too fast-changing, and too hard to police.It should be entirely results-based. You lose people's data, you pay big bucks. Figuring out how not to lose it is your problem. The government sets the rules, and the market plays the game.