Should corporate boards face personal accountability for repeated privacy violations?

We already ran this experiment. The FTC's 2019 Facebook order did not just fine the company. It required Mark Zuckerberg to personally certify, every quarter, that the company was complying with privacy rules. FTC A named human being, signing his name, on the record. That is the model worth extending: not prison for every breach, but a personal signature on compliance, with personal consequences when the signature turns out to be fiction and the violations repeat. Boards approve risk memos the way people approve software updates, without reading them. A signature that can cost you changes what you read before you sign.