I get that we all have a desire to do the right thing, and as convention-runners have a responsibility, often legal, to others (and their personal data).

However, what we don't have for data protection - is an accurate and informed assessment of the risks and, most importantly, the actual liability if these risks happen. And that might be a little complicated, given the international membership of conventions.

So we're treating data protection like H&S by analogy of risk - and that really isn't correct.

(which is a long-winded way to say, I agree).