Should corporate boards face personal accountability for repeated privacy violations?

A company fine is ultimately paid by shareholders, customers, and employees. Repeated violations mean oversight failed, so the people signing off on risk should not be insulated forever. One U.S. proposal described by Cleary would require annual officer certifications and punish knowingly false ones. That is narrower than blaming directors for every breach and targets dishonesty at the top.