Should corporate boards face personal accountability for repeated privacy violations?

Accountability needs a clean line of responsibility. “The board” can mean ten people with different committees, information, and votes. Treating every repeat incident as personal failure ignores sophisticated attacks and inherited systems. The better move is mandatory board reporting, named privacy officers, and public remediation milestones, consistent with privacy's rise as a governance issue.