Any operator who gets caught out storing sensitive information without paying in gets to foot the bill themselves.
That's the status quo today. It hasn't prevented any company from storing our information safely for the past 25 years.
Satan (impatiently) to Newcomer: The trouble with you Chicago people is, that you think you are the best people down here; whereas you are merely the most numerous. - - - Mark Twain, "Pudd'nhead Wilson's New Calendar" 1897
Whenever there is a fine for fraud or negligence, the fine should be after they've forfeited the entire profit made from the activity. A billion-dollar fine sounds like a lot, until you consider the 14 billion they made because of the fraud.