If anything, I think software needs more of these sort of top down safety rules. I want to companies held financially / criminally responsible for data leaks. Just like restaurants are held responsible for food safety.