Aaron Swartz faced 35 years in prison for leaking JSTOR articles.
Instead of fines, the Chief Security Officer should be fully responsible and face 35 years in jail if a breach happens.
You better believe they'll care about security then.
Many companies would also rethink whether they need to track and keep personal information at all.