as to why. First you suggest that " Broad privacy regulations are better than narrow ones." This is only partly true. PII changes and as such specific regulations that are focused on that information being private and kept that way would be far better than some broad regulation that leaves too much to interpratation, especially in say a court proceeding. Second you contend: "It's far better to regulate results than methodology." This is a non starter as without some means or method by which to set a privacy regulation, you cannot logically have good knowledge of any results. @NoSuchThingAsIdentityTheft: Exactly. I've been saying just that for years. If a bank gives someone money; it is the LENDER's responsibility to get the money back from THAT PERSON. If that person gave them MY information fraudulently and the bank didnt bother to verify it, well then the bank is defective and needs to fail and be survived by a fitter organization that can confirm identity competently. Information about a person should legally be the property of the person it refers to; not the property of someone who happens to be entrusted with it (temporarily). If I let you use my chainsaw to cut down a tree for me, it does not become your chainsaw. If I let you use my car to drive me to and from a Dr. appt; it is not somehow now magically your car. Similarly if I loan you (you being a credit bureau in this instance) my