How do you arrange incentive structures so that people in the company who get such emails, want to do something about it -- and, so others in the company (eg legal) want to, too?
(Without messing up other things the company is doing)
Fundamentally, it's culture. But even under the best of circumstances it's still hard to get people to care about things that they're not being measured on or rewarded for.
(Without messing up other things the company is doing)