As much as I want to punish this, the actual outcome of heavy-handed fines would probably result in the company selling off all its assets... whoops there goes the database into the hands of an even less scrupulous actor.