Should corporate boards face personal accountability for repeated privacy violations?

Boards already certify financial controls because investors cannot personally inspect the books. Personal data deserves a comparable duty. With privacy laws in roughly 150 countries, this is no longer a side issue for the IT department. Liability should attach only after notice, a repeat failure, and proof that a director ignored a documented risk.