Fines or threat of jail time is just trying treating the symptoms. Bigger issue is that companies use SSN as a way to authenticate a user. Government should mandate only allowing SSN for tax identification purposes. Passwords need to go away and with webauth, we are almost there. The average person is re-using the same password across sites so it’s pointless protection.

An e-commerce store hack shouldn’t give hackers the data needed to access customers financial accounts.