The US government is talking about giving firms who follow best practices security a break on taxes. This would augment the disclosure rules that are now in effect that force companies to report to their customers if their information has been compromised.

The Japanese government put the Personal Information Privacy Act into effect in April of 2005. This act allows companies to be fined for divulging sensitive customer data.

We have the carrot and the stick approach in two different markets. Which approach do you think will be more successful?