Comment by jenscow

Agreed. However, the punishment shouldn't just be financial, otherwise it will just be risk-assessed.

How about a ban on the data collection for a period, or lose the ability to use it.