...their personal data" all over the Internet. If you can obtain all you need to copy somebody's identity from their Facebookprofile then why should business x be penalised if they have a compromise of that same person's details when it's all...
http://www.computerweekly.com/blogs/stuart_king/2008/11/eurim-governance.html