Companies, not people, should bear the burden of protecting data (Brookings)