Liability is the key - if you don't encrypt then you're 100% liable.
Working in the data security business myself these days if you for example loose a laptop and it wasn't encrypted and the data loss is significant - you're liable because you didn't make even reasonable attempts to protect the data. Encrytion is easy to do and hard to break - especially on fly encrypted file transfers - easy as freakin pie man...no excuses - ROI is instant good
pr.
You're fired. End of story.