I agree with you, Gail. After spending a year as a usability engineer for a company that produces enterprise database software primarily to banks, two things became very clear. First, software that stores personal data is constantly changing and built in a Rube Goldberg-like fashion by the enterprise/organization using the software. The technical and development abilities within these organizations varies widely with some organizations being at a greater risk of a security breach because of the quality and experience of their technical staff. This seemed to be a function of the quality of recent computer science graduates available to the organization and less a function of managerial practices. Second, personal information is treated as any other information inherent to the business' operation. Compliance with government regulation is taken very seriously by the technical folk who manage the information, but the wider implications of personal data accessibility and unanticipated paths of data loss are not a consideration in day to day operations. In their opinion, data is a business commodity meant to be sold and shared. Subsequent to my year's experience, I have become very selective with where I do business and what spelling of my name I wish to provide. I feel that regulations should have been in place decades ago, before the "cat was out the door". Future regulation and research may wish to consider the effect of the new personal information regulations in the UK and the technological restraints it has placed on banking growth. Regards, Jo Elliott