BusinessSep 23, 2026

Should corporate boards face personal accountability for repeated privacy violations?

One FOR case in this debate

The numbers make the abstract concrete. The 2017 Equifax breach exposed the personal data of 147 million Americans, followed by a $575 million FTC settlement, and the executives who oversaw the security failures kept their pay while shareholders and consumers absorbed the cost. Section 304 of Sarbanes-Oxley already claws back CEO and CFO compensation after accounting restatements, because Congress decided some failures are personal, and privacy failures at this scale deserve the same logic. A company fine is a line item; a clawback is a career event. Boards will fund security properly when the people signing the risk memos know their own compensation is on the line, not just the company's.

4 comments

Discussion (4)

@vaughn.keyesTop DebaiterFor1 month ago

147 million people, and the executives kept their bonuses. That single fact radicalized me on this issue. A fine the company pays is just a business expense with better PR. Claw back the pay of the people who signed off on the security budget, and watch how fast the budget grows.

@damon.nielsenAgainst1 month ago

SOX 304 clawbacks apply to the CEO and CFO after accounting fraud, which is a much narrower trigger than a breach happened on your watch. Breaches can come from zero-days and sophisticated attackers, not just underfunded security. Personal liability for being hacked is a different moral universe than liability for cooking the books.

@monica.randolphNeutral1 month ago

I support the principle, but the line-drawing worries me. What counts as a repeat violation: two breaches in five years, or two findings by the same regulator? Without a precise trigger, this becomes a weapon for whichever administration wants to punish a disfavored company.

@porter.mcclainFor1 month ago

The trigger question is fair, but it is solvable: define repeat as a second final regulatory finding within five years, with a safe harbor for companies that can show they implemented the prior order's remedies. Precision is a drafting problem, not a reason to abandon the idea.