The Federal Trade Commission is taking a tougher stance on companies that fail to safeguard consumer data—and is even going so far as to hold individuals personally accountable for those failings.

Two recent cases demonstrate the agency’s willingness to go after individuals. In early October, a federal jury convicted former Uber security chief Joseph Sullivan of concealing a 2016 data breach from law enforcement and obstructing an investigation by the FTC into Uber’s security practices. A federal judge will hear his motion for acquittal next month.