Re: outrageous
"Perhaps throwing personal criminal liability on company executives is long overdue and should be extended to other aspects of company conduct."
Let me qualify that: liability to company executives when specific individuals can be identified as culpable in a specific case.
If legislation seeks to make individuals liable as opposed to the corporation that that would almost certainly need to be the directors as no other job titles are defined in law. The alternative would be if the legislation defines a specific role such as a data protection officer who could be held responsible whatever the job title - with a fall-back to the directors if they fail to appoint and empower one.