We have a set of standards that define what negligence looks like for data breaches, security, etc. If a company is found to not adhere to these standards they would be found negligent and assessed some financial penalty.
If a company is found to be adhering to the standards, and is hit by a 0-day, the financial penalty would be negligible or 0.
Some standards like PCI attempt to do this, but to date they have no real teeth. GDPR may be the change we need.
I have deep concern that C-levels will learn that breaches don’t matter, just have a CISO you can behead and replace when it does.
Yes, I agree completely, that C-levels will see that the CISO is a replaceable widget that is nothing more than a scapegoat.
I don't know how you define "deliberately doing something wrong" without either making it too broad or worthless.
It's rare that any organization "deliberately" exposes their customer information. It's also effectively impossible for any organization to guarantee that the data is unbreachable.
It's perfectly possible to have a data breach and not get fined, and as long as you didn't do anything too careless that would allow a breach to happen you're probably in the clear.
Everyone knows there's no perfect system.. but in regards to what we're talking about it's much better to have personal data be a liability rather than an asset, because it puts incentive on companies to only use what they need and make efforts to protect it appropriately.
What if I'm just unaware of the standard or incompetent?
Not all programmer who save password in plaintext starts by thinking "I'm going to intentionally doing this wrong so that it breaks all security guidelines".
Who determines how much careless is "too" careless? "slightly careless" but with huge consequences is more concerning than "incredibly careless" but with no consequences.
Really the punishment should be matching the value of the breach. For example with HIPAA breaches, you can get fined $10k or so, PER RECORD -- obviously medical data is exceptionally more sensitive than most. Credit data should be covered under a HIPAA-like statute. Under HIPAA there's no such thing as "a little careless" -- you either f'ed up or you didn't. There's no gray area.
Lets not pretend we will get a perfect law the first time around. Closing a few gaps is already a good first effort. We just need to be willing to close a few more as we discover them. Note too that there are always unintended consequences - we also need to be quick for calling for the elimination of a well intended law where the unintended result is a negative, even if it does get some bad actors.