Doesn't the Sarbanes-Oxley act (Sec 906) mandate that publicly listed companies' CEO&CFO assume at least some personal liability when they sign each required SEC statement (10-Q, annual report, etc)?
Something new for them: """ CEOs are required to personally attest that they are responsible for changes to privacy practices and written policies. """