alt Hacker NewsCivil damages can become merely a "cost of doing business".
Jail time for the responsible executives makes it personal for the decision makers. Obviously there still needs to be due process. It would be sensible to have stages where there are clear warnings given by the relevant regulators with indications of the specific remediation actions required and then a reasonable amount of time to actually implement that remediation before anyone is getting carted off in handcuffs for non-compliance.
I am not generally in favour of piercing the corporate veil but in cases of flagrant and deliberate disregard for the law I think there is a point where it becomes justified and perhaps even necessary.
I see the point. My misgiving is that jail time means the government can just refrain from enforcing it because the leaders have found favor with one another.
A data breach of 10 million records, times $10k per offense, might not deter Google, but it would raise the eyebrows of smaller violators. An industry of class action lawyers might emerge to specialize in those claims.