If we made the ramifications of personal data being stolen, mishandled leaked etc. fairly serious and punitive on companies then I’m sure most companies would not even entertain the notion of needing it.