Corporations are still failing to deliver on efforts to tighten up information security and consumer privacy, despite all the bad publicity and legal risks that they—and everyone else—are already painfully aware of, according to a new study on the problem.

The report, conducted by Accenture and the Ponemon Institute, surveyed 5,500 business leaders to see how well their intentions for data security match the actual protections they give to personal information such as addresses, birth dates, and Social Security numbers. Bottom line: There’s a big gap between the two, says Bill Phelps, executive director of Accenture’s North American security practice.