Should corporate boards face personal accountability for repeated privacy violations?

Directors oversee systems; they do not configure every database. Threatening prison or personal ruin for negligence, as one proposal summarized by Cleary contemplated, could drive qualified people away and reward defensive paperwork over security. Use clawbacks for proven misconduct and reserve personal penalties for fraud, concealment, or deliberate lawbreaking.