> You can't really legislate serious penalties for mistakes, and negligence is really really hard to prove.

You can legislate serious penalties for negligence, of which a great number of PII breaches would, IMHO, be candidates for.