may be a requirement. The same should hold for other businesses that store/use personal information. When this is no longer an externality, and businesses are held responsible, the problem will go away. Unfortunately, the only way I see this being fulfilled is through government regulation, by forcing the financial incentives (i.e. fines) necessary to change this from an externality. As Samsam points out, any regulations hit small businesses harder than large ones, because the cost of complying with regulations isn't linear with the size of the business, and in a results-oriented regime with significant penalties there is no good way to manage the risk. Moreover, I've been reading a few stories about people with low-end websites screwing up due to basic misunderstandings. Possibly, what we need to do is encourage hosted solutions, which will be run by people who actually know what they're doing. I don't know the best way of encouraging that, or keeping the cost low enough for very small businesses and/or hobby websites, but I don't see a better way out of the problems. there are plenty of methods to control costs of pii protection, especially considering that most pii wrecks occur from inside the business. seems like it would be easier for a small business to maintain a secure pii system, as there would be fewer employees and machines to monitor for screw-ups. There are some simple, low-cost solutions a small business can do to protect data. Last year, as I was going through the process