Some good points, but sometimes it can be difficult to get an organization to think about security if they have never had a problem. Its kind of like the situation when a stop light is only installed in an intersection after several car crashes have occured.  I am not big on making more  laws, but I think the Feds need to place stronger requirements on companies that are storing our data. They should require some kind of security audit on a regular basis.  This would help the security industry, customers and venders in the long run.  There are still companies that save all your info in a very insecure manner.  Vulnerable computers with all your info sitting on simple excel spread sheets, etc...