Rethinking Corporate Accountability in the Digital Age
Abstract
This article examines the limitations of relying exclusively on criminal enforcement to protect personal data. It argues that effective protection requires a comprehensive legal framework combining criminal enforcement, preventive cybersecurity obligations, corporate accountability, and effective remedies for affected individuals.
Introduction: Your Data Is More Valuable Than You Think
Imagine waking up to discover that your personal information, financial details, or private conversations have been exposed online—circulating among strangers, used for fraud, or sold on the dark web.
Who is responsible: the hacker who stole the data, or the company that failed to protect it?
At first glance, the perpetrator of the cyberattack should be punished. Cybercrime is a serious threat, and those who illegally access or misuse personal data must face legal consequences. However, focusing exclusively on the offender ignores another critical factor: the organisations collecting, storing, and processing vast amounts of personal data.
Where personal data is a valuable economic asset, its protection cannot remain a purely technical matter for cybersecurity teams; it is also a legal duty. The core question is not merely how to punish data thieves, but how to prevent organisations from exposing data initially.
1. The International Legal Framework: Privacy Is More Than a Personal Choice
Personal data protection is closely tied to the fundamental right to privacy, recognised internationally under Article 17 of the International Covenant on Civil and Political Rights (ICCPR), protecting individuals against arbitrary or unlawful interference with their privacy, family, home, and correspondence.[1]
In General Comment No. 16, the UN Human Rights Committee clarified that protection against unlawful interference extends beyond public authorities to include natural and legal persons, including private organisations, emphasising that States must adopt legislative and other measures to make this protection effective.[2]
In the digital age, privacy is threatened not only by State surveillance, but also by companies that collect excessive data, fail to secure their systems, or permit unauthorised access.[3]
While the ICCPR does not directly bind private companies, it obliges States to establish and enforce effective protection. Governments must therefore build legal frameworks that make privacy meaningful whenever private entities handle personal data.
2. Why Punishing Hackers Is Not Enough
Criminal law remains essential in responding to cyberattacks. Illegal access, data interference, and computer-related fraud are not mere technical violations; they cause severe financial and personal harm.
The Council of Europe’s Budapest Convention on Cybercrime exemplifies international cooperation in this field, establishing a framework for criminalising cyber offences, investigating crimes, securing electronic evidence, and facilitating inter-State cooperation.[4]
This is particularly vital for cross-border cyberattacks, where perpetrators operate from one jurisdiction, route through servers in another, and target victims globally. Without law-enforcement cooperation, investigating such offences becomes exceedingly difficult.[5]
Yet criminal enforcement has limits. Prosecuting a hacker post-breach neither restores exposed data, prevents identity theft, compensates victims, nor remedies the vulnerabilities that enabled the intrusion.
While criminal investigations identify the intruder, they do not assess whether the data-holding organisation maintained adequate security safeguards. Both legal questions require distinct attention.
Cybercrime law targets the attacker; data-protection law must address the organisation entrusted with the data.
3. Companies Must Do More Than Protect Their Reputation
Organisations often portray data breaches as inevitable amid sophisticated cyber threats. While no system guarantees absolute security, the risk of attack cannot excuse a failure to implement reasonable preventive safeguards.
The European Union’s General Data Protection Regulation (GDPR), though a regional instrument rather than a global treaty, offers an influential model for translating corporate responsibility into binding legal obligations.[6]
The GDPR requires appropriate technical and organisational measures to ensure secure data processing, while mandating data protection by design and by default—integrating privacy safeguards into system architecture from the outset rather than after a breach.[7]
This reshapes corporate responsibility. Data protection extends beyond installing security software or crisis management to encompass risk assessment, data minimisation, access control, staff training, regular audits, and evolving safeguards.[8]
The law should not treat every breach as automatic proof of corporate fault; a diligent company may still suffer a sophisticated attack. The decisive question is whether it fulfilled its legal duties and adopted safeguards proportionate to the risks.[9]
Accountability must therefore rest on compliance with legal obligations and case-specific circumstances, not merely the occurrence of a breach.
4. From Legal Protection to Real Accountability: What Needs to Change?
Recognising corporate responsibility is only the first step; effective protection requires incentivising risk prevention rather than post-breach crisis management.
The OECD Privacy Guidelines advance a key principle: accountability. Data controllers must demonstrate active compliance through privacy-management programmes, risk-based safeguards, internal oversight, and incident-response procedures.[10]
This distinguishes formal privacy policies from substantive data protection; published commitments mean little if internal practices fail to reflect them.[11]
An effective framework should therefore centre on four interconnected priorities.
- Organisations must assess data risks prior to collection and processing, ensuring data volume and sensitivity remain proportionate to a legitimate purpose.
- Companies must implement and regularly update practical security measures, maintaining continuous protection as technology, business models, and cyber threats evolve.
- Regulators require adequate powers and expertise to investigate compliance failures, mandate corrective action, and impose proportionate sanctions for breaches of legal duty.
- Affected individuals must have meaningful access to information and effective remedies. Transparency ensures victims are promptly notified of breaches and informed of available recourse.
While these measures cannot eliminate cybercrime, they reduce preventable risks, strengthen institutional accountability, and ensure the burden of data protection does not fall solely on individuals.
Conclusion: Data Protection Is Everyone’s Responsibility
The digital economy relies on collecting and exchanging personal data, driving innovation, communication, and growth while generating legal responsibilities that cannot be ignored.
Prosecuting hackers is necessary but insufficient. A legal system that punishes data thieves while overlooking the organisations entrusted with safeguarding data leaves a critical gap in privacy protection.
While companies cannot prevent every attack, they must act responsibly, assess risks, implement proportionate safeguards, and demonstrate compliance with their legal obligations.
Ultimately, personal data is more than digital records; it represents individual identity, financial security, private life, and institutional trust.
The question is no longer whether organisations bear a duty to protect personal data, but whether legal systems are prepared to make that accountability effective.