Data protection and information security

An interesting discussion in the Register about the loss of a laptop containing 550,000 full credit histories in the US - do you think the individual who lost the data or his company should be liable?