This editorial was originally published on March 12, 2015 and is being re-run as Steve is at the PASS Summit.

Recently a court in the US ruled that there was no imminent danger from a data breach at a Texas hospital. This is good news and bad news for the world, and I'm a little torn about how I feel. On one hand, it's good for us as data professionals that we aren't necessarily going to be liable for the immediate effects from lost data. While the losses aren't always our fault, we certainly could feel pressure from management if companies faced immediately legal or financial penalties.

However it's bad news because I think there's little else that data breaches do than cause harm to those whose information is lost. It can be incredibly hard to link a specific breach to a specific identity theft incident, and I see this as a way of allowing companies to escape liability for their poor security practices.

In reality, however, I have no solution to propose. As a data professional, I try to keep data safe, but it's very, very difficult. One small hole in your technical infrastructure or human employees and you can lose a ton of data very, very quickly. I know it's not lost, but copied, however you have lost control of it.

We will face more and more security incidents, and as those tasked with protecting data, I'm not sure what we can do, or should do. However, I do think that organizations can't take all responsibility, nor can they take no responsibility. The balance of how to deal with losses and issues is certainly something I hope we work out a a society.

Soon.