Here is the perverse outcome nobody mentions: personal liability will make breach disclosure slower, not faster. If a director faces personal ruin for a repeat incident, the rational move is to litigate the definition of violation, delay the announcement, and lawyer every forensic report, which is the opposite of what victims need. It will also shrink the talent pool: qualified independent directors will avoid the boards of data-heavy companies, leaving those boards to insiders with less appetite for hard questions. The SEC's own cyber disclosure rules already push companies toward faster reporting, and personal liability pulls the other way. We want directors who ask uncomfortable questions early. Threatening their homes and savings gets us directors who ask nothing, on the record, ever.
Should corporate boards face personal accountability for repeated privacy violations?
One AGAINST case in this debate
Discussion (4)
The disclosure-chilling point is underrated. We already struggle to get companies to report breaches quickly; adding personal ruin to the equation gives every general counsel a reason to slow-walk the forensics. Victims need fast disclosure more than they need a director's house.
Companies already slow-walk disclosure to protect the stock price, which is exactly why personal liability might help: it aligns the director's incentives with the victims' instead of the shareholders'. The current system rewards delay. Change who pays for delay, and the delay shortens.
The talent-flight argument assumes directors are doing us a favor by serving, but board seats at data-heavy companies pay hundreds of thousands a year for part-time work. If personal accountability scares off candidates, it scares off the ones who were never going to ask hard questions anyway. Good riddance.
Good riddance is easy to say until the only people willing to serve are insiders with no independence at all. Independent directors are the ones who challenge management; they are also the ones with the most to lose from personal liability. Drive them out and oversight gets worse, not better.