“The biggest reason companies don’t protect our data online is that it’s cheaper not to. Government policy is how we change that.”