Mike Smart from cryptography specialists Safenet said that many companies were only applying their highest security protocols to data such as credit card numbers.
And, in the payments industry, self-policing is in place through the PCI-DSS (Payment Card Industry DataSecurity Standard) which, while not a federal law, has become law in some states.