The fine should be proportional to the damage. A tiny medical startup that leaks psychotherapy records “hurts” more than a company that leaks your shoe size.
Perhaps companies should buy insurance for this and then that would incentivize insurance companies to help protect their clients. Insurance requirements are a significant safety factor at many physical businesses. The law is important, but being denied insurance claims is a great private-sector solution. Or course for insurance to be meaningful, the penalties have to have significant teeth. However, a mega-Corp (by revenue) would likely self-insure, however they’d still have incentive to do right if the penalties were per record, not per breach. For HIPAA, there’s a fine of up to $10k per record for a breach. 10k times 200,000,000 users affected becomes real money even to Facebook. And, let’s make the fines payable to the user, not the government. The user is the one incurring the harm, not the government. The government still gets their slice since such awards are taxable.