We would like to see significant penalties in the case of a major breach. I'm thinking in terms of something like the Winners incident. I would go as high as saying that they must notify each individual customer, with penalties up to $100,000, escalating for each incident. Make it serious.
On February 15th, 2007. See this statement in context.